WO2021153224A1 - Information processing device and information processing method - Google Patents

Information processing device and information processing method Download PDF

Info

Publication number
WO2021153224A1
WO2021153224A1 PCT/JP2021/000757 JP2021000757W WO2021153224A1 WO 2021153224 A1 WO2021153224 A1 WO 2021153224A1 JP 2021000757 W JP2021000757 W JP 2021000757W WO 2021153224 A1 WO2021153224 A1 WO 2021153224A1
Authority
WO
WIPO (PCT)
Prior art keywords
program
partial
update
data
area
Prior art date
Application number
PCT/JP2021/000757
Other languages
French (fr)
Japanese (ja)
Inventor
宏和 玉野
孝彦 上辻
大輝 松田
Original Assignee
パナソニックＩｐマネジメント株式会社
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by パナソニックＩｐマネジメント株式会社 filed Critical パナソニックＩｐマネジメント株式会社
Priority to DE112021000801.3T priority Critical patent/DE112021000801T5/en
Publication of WO2021153224A1 publication Critical patent/WO2021153224A1/en
Priority to US17/563,833 priority patent/US11886869B2/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F8/00—Arrangements for software engineering
    • G06F8/60—Software deployment
    • G06F8/65—Updates
    • G06F8/658—Incremental updates; Differential updates
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/14—Error detection or correction of the data by redundancy in operation
    • G06F11/1402—Saving, restoring, recovering or retrying
    • G06F11/1415—Saving, restoring, recovering or retrying at system level
    • G06F11/1433—Saving, restoring, recovering or retrying at system level during software upgrading
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/36—Preventing errors by testing or debugging software
    • G06F11/3668—Software testing
    • G06F11/3672—Test management
    • G06F11/3688—Test management for test execution, e.g. scheduling of test suites
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F13/00—Interconnection of, or transfer of information or other signals between, memories, input/output devices or central processing units
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F8/00—Arrangements for software engineering
    • G06F8/60—Software deployment
    • G06F8/65—Updates

Definitions

  • This disclosure relates to an information processing device and an information processing method.
  • Patent Document 1 discloses an electronic control device that saves old information stored in a memory to a memory different from the memory when rewriting the old information to new information.
  • the present disclosure provides an information processing device and the like that can reduce the storage capacity of the storage used when updating a program.
  • the information processing device in the present disclosure acquires data for updating the first program from a storage unit in which the first program is stored and an external device, and uses the acquired data to newly use the first program.
  • the update control unit includes an update control unit for updating to a second program, and the update control unit is a plurality of first portions in which a first storage area, which is a storage area of the storage unit in which the first program is stored, is divided.
  • the data is sequentially updated to the second partial program which is a part of the second program by using the partial data corresponding to the first partial program, and the data is the first program and the first program. It is the difference information indicating the difference between the two programs, and the storage capacity of the second storage area is smaller than the storage capacity of the first storage area.
  • the information processing device and the like in the present disclosure can reduce the storage capacity of the storage used when updating the program.
  • FIG. 1 is a schematic diagram of a system for delivering a program for updating to an automobile according to an embodiment.
  • FIG. 2 is a block diagram showing an example of the hardware configuration of the server according to the embodiment.
  • FIG. 3 is a block diagram showing an example of the hardware configuration of the information processing device included in the automobile according to the embodiment.
  • FIG. 4 is a block diagram showing an example of the functional configuration of the information processing apparatus according to the embodiment.
  • FIG. 5 is a diagram for explaining control of update processing and provision processing according to the embodiment.
  • FIG. 6 is a diagram for explaining a detailed example of the update process according to the embodiment.
  • FIG. 7 is a diagram for explaining a first example of processing when the update processing according to the embodiment fails.
  • FIG. 8 is a diagram for explaining a second example of processing when the update processing according to the embodiment fails.
  • FIG. 9 is a flowchart showing an example of the update process by the information processing apparatus according to the embodiment.
  • FIG. 10 is a flowchart showing an example of the provision process by the information processing apparatus according to the embodiment.
  • FIG. 11 is a flowchart showing a first example of rollback processing by the information processing apparatus according to the embodiment.
  • FIG. 12 is a flowchart showing a second example of rollback processing by the information processing apparatus according to the embodiment.
  • FIG. 13 is a flowchart showing a third example of rollback processing by the information processing apparatus according to the embodiment.
  • FIG. 14 is a block diagram showing an example of the functional configuration of the information processing apparatus according to the first modification.
  • FIG. 15 is a diagram showing a configuration of a virtual machine that realizes the function of the information processing device according to the first modification.
  • the electronic control device of Patent Document 1 has a storage capacity capable of storing the old information because the old information stored in the memory is saved in a memory different from the memory when the old information is rewritten to the new information. Separate memory is required. Alternatively, even if the old information is saved in the same memory, a memory having an extra storage capacity capable of storing a copy of the old information is required. Therefore, another memory or a large amount of memory is required.
  • the inventors have found an information processing device and an information processing method capable of reducing the storage capacity of the storage used when updating the program.
  • the information processing device acquires data for updating the first program from a storage unit in which the first program is stored and an external device, and uses the acquired data to obtain the first program.
  • the update control unit includes an update control unit that updates the program to a new second program, and the update control unit is a plurality of divided first storage areas that are storage areas of the storage unit in which the first program is stored. After copying the first partial program, which is a part of the first program stored in the first partial area, to a second storage area different from the first storage area for each of the first partial areas of the above.
  • the first partial program is sequentially updated to the second partial program which is a part of the second program by using the partial data corresponding to the first partial program among the data, and the data is the first. It is the difference information indicating the difference between the program and the second program, and the storage capacity of the second storage area is smaller than the storage capacity of the first storage area.
  • the first part program is saved by copying the first part program stored in the first part area to be updated to the second storage area, and then the first part is saved.
  • the first subprogram stored in the area is updated to the second subprogram. Therefore, even when the first partial area during the update process is accessed, the saved first partial program can be used instead of the first partial program during the update process, and the access source device can be used.
  • a program can be provided. Further, since the data used for the update is the difference information and the program to be saved is the first part program of a part of the first program, the storage capacity of the storage used at the time of updating the program can be reduced. ..
  • the first program includes a first controller, an update control unit, and a second controller having a supply unit that provides the storage unit as virtual storage to the first control unit.
  • the program may be executed by the first controller at startup.
  • the program of the first control is updated without using the first control. Can be done. Therefore, the program of the first control to be updated can be updated so as not to affect the first control.
  • the access destination of the access is If it is the first partial area after the update process, the second partial program stored in the first partial area is provided to the first controller, and (ii) the first access destination is in the process of updating. If it is a partial area, the first partial program is updated by using the first partial program stored in the second storage area and the partial data corresponding to the first partial program in the data. A second partial program is generated, and the generated second partial program is provided to the first controller. (Iii) If the access destination is the first partial region before the update process, the first partial region is used. Using the stored first partial program and the partial data corresponding to the first partial program in the data, a second partial program in which the first partial program is updated is generated, and the generated first portion program is generated. A two-part program may be provided to the first controller.
  • the second program is provided to the first control even during the update processing from the first program to the second program. be able to.
  • the difference information includes a plurality of first data units constituting the first program, a plurality of difference data indicating a difference between a plurality of second data units constituting the second program, and the plurality of difference data.
  • Each difference data may include the first data unit corresponding to the difference data and the correspondence information for specifying the second data unit.
  • the first data unit to which the difference data is applied can be easily specified. Therefore, the processing load related to the generation process of the second subprogram and the processing time related to the generation process can be reduced.
  • the update control unit stores the first plurality of first partial areas in the first partial area. After updating the partial program to the second partial program and updating the first program to the second program, the plurality of first storage areas in which the second program is stored are divided. For each of the partial areas, the second partial program, which is a part of the second program stored in the first partial area, is copied to the second storage area, and after the copy, of the data The second partial program may be updated to the first partial program which is a part of the first program by using the partial data corresponding to the second partial program.
  • the update control unit when the update fails while the update control unit is updating the first program, the update control unit includes one or more updated first partial areas and the updated first partial area, respectively. After copying the second partial program, which is a part of the second program stored in the first partial area, to the second storage area, the portion of the data corresponding to the second partial program.
  • the second subprogram may be updated to the first subprogram using the data.
  • the first partial region in which the update fails is a specific first portion of the plurality of first partial regions. It is determined from the area whether it is before or after the processing order, and as a result of the determination, when the first partial area for which the update has failed is before the specific first partial area in the processing order, the plurality of updated items.
  • the second partial program which is a part of the second program stored in the first partial area, was copied to the second storage area. Later, the second partial program is updated to the first partial program using the partial data corresponding to the second partial program in the data, and as a result of the determination, the update fails in the first partial region.
  • the first partial program stored in the first partial region is used as the second partial program for all the plurality of first partial regions.
  • the second subregion is divided for each of the plurality of second subregions in which the third storage area in which the second program is stored is divided.
  • the third partial program which is a part of the second program stored in, is copied to the second storage area, and after the copy, the partial data corresponding to the third partial program is used in the data.
  • the third partial program may be updated to the fourth partial program which is a part of the first program.
  • FIG. 1 is a schematic diagram of a system for delivering a program for updating to an automobile according to an embodiment.
  • FIG. 1 a server 100, an automobile 200, a communication network 300, and a base station 310 of a mobile communication network are shown.
  • the server 100 is a device that stores a program (firmware) of an electronic device such as an ECU (Electronic Control Unit) included in the automobile 200, and provides the program to the automobile 200 via a communication network 300.
  • a program firmware
  • ECU Electronic Control Unit
  • the automobile 200 is a mobile body capable of communicating with the mobile communication network via the base station 310.
  • FIG. 1 shows an example in which the ECU program is updated by delivering the program for updating the ECU of the automobile 200 to the automobile 200 by OTA (Over The Air).
  • the method of updating the ECU program is not limited to updating using OTA.
  • a method may be used in which the update device is connected to the automobile 200 by wire and the update program recorded on the recording medium using the update device is applied to the ECU of the automobile 200. That is, each ECU included in the automobile 200 may acquire the update program by wireless communication by OTA or the like, or may acquire the update program by wired communication via the update device or the like.
  • FIG. 2 is a block diagram showing an example of the hardware configuration of the server according to the embodiment.
  • the server 100 includes a CPU 11 (Central Processing Unit), a main memory 12, a storage 13, and a communication IF (Interface) 14 as a hardware configuration.
  • a CPU 11 Central Processing Unit
  • main memory 12 main memory
  • storage 13 main memory
  • communication IF Interface
  • the CPU 11 is a processor that executes a control program stored in the storage 13 or the like.
  • the main memory 12 is a volatile storage area used as a work area used by the CPU 11 when executing a control program.
  • the storage 13 is a non-volatile storage area for holding control programs, contents, and the like.
  • the communication IF 14 is a communication interface that communicates with a plurality of automobiles 200 via the communication network 300.
  • the communication IF 14 is, for example, a wired LAN interface.
  • the communication IF 14 may be a wireless LAN interface.
  • the communication IF 14 is not limited to the LAN interface, and may be any communication interface as long as it can establish a communication connection with the communication network.
  • FIG. 3 is a block diagram showing an example of the hardware configuration of the information processing device 210 included in the automobile according to the embodiment.
  • the information processing device 210 includes a TCU (Telematics Control Unit) 21 and n ECUs 22 as a hardware configuration.
  • the information processing device 210 does not have to include all the hardware configurations shown in FIG.
  • the information processing device 210 does not have to have the TCU 21.
  • the TCU 21 is a communication unit in which the automobile 200 performs wireless communication with the communication network 300.
  • the TCU 21 is a communication unit including a cellular module corresponding to the standard of the mobile communication network.
  • the n ECUs 22 are control circuits that execute control of various devices such as an engine, a motor, a meter, a transmission, a brake, a steering wheel, a power window, and an air conditioner included in the automobile 200.
  • n ECUs 22 are provided corresponding to each of these various devices.
  • each of the n ECUs 22 may include a storage unit (nonvolatile storage area) for storing a program executed by each ECU 22.
  • the storage unit is, for example, a non-volatile memory.
  • the storage 23 is a non-volatile storage area for holding a control program or the like.
  • the storage 23 is realized by, for example, an HDD (Hard Disk Drive), an SSD (Solid Stated Drive), or the like.
  • FIG. 4 is a block diagram showing an example of the functional configuration of the information processing device 210 according to the embodiment.
  • the information processing device 210 includes a management ECU 220, an ECU 230, and a storage unit 240.
  • the management ECU 220 is an ECU that manages updates of programs executed by the ECU 230.
  • the management ECU 220 provides the ECU 230 with a storage unit 240 that functions as virtual storage.
  • the management ECU 220 is realized by, for example, at least one of n ECUs 22.
  • the management ECU 220 may include the TCU 21.
  • the management ECU 220 is an example of the second controller.
  • the storage unit 240 is provided to the ECU 230 as virtual storage via the management ECU 220.
  • the storage unit 240 has a first storage area 241, a second storage area 242, and a third storage area 243.
  • the first storage area 241 stores a first program executed by the ECU 230 at startup.
  • the first program is the program currently in use by the ECU 230.
  • the program currently in use by the ECU 230 is a program that is defined to be used when the ECU 230 is started, and does not necessarily mean a program that is being executed by the ECU 230.
  • the second storage area 242 is a storage area different from the first storage area 241 and has a storage capacity smaller than the storage capacity of the first storage area 241.
  • the second storage area 242 is a storage area that is used when updating the first program and temporarily stores the first partial program that is a part of the first program.
  • the third storage area 243 is a storage area in which update data used for updating the first program is temporarily stored.
  • the third storage area 243 is a storage area different from the first storage area 241 and the second storage area 242, and has a storage capacity smaller than the storage capacity of the first storage area 241. Further, the storage capacity obtained by adding the storage capacity of the second storage area 242 and the storage capacity of the third storage area 243 is smaller than the storage capacity of the first storage area 241.
  • the storage unit 240 is realized by the storage 23.
  • the ECU 230 accesses the first storage area in which the first program of the storage unit 240 is stored, and executes the first program.
  • the ECU 230 realizes its own function by executing the first program at the time of startup.
  • the ECU 230 is realized by, for example, at least one ECU different from the ECU 22 that realizes the management ECU 220 among the n ECUs 22.
  • the ECU 230 is an example of the first controller.
  • the management ECU 220 has an update control unit 221 and a provision unit 222.
  • the update control unit 221 controls an update process for updating the first program executed by the ECU 230 to a new second program. Specifically, the update control unit 221 acquires update data, which is data for updating the first program, from an external device, and updates the first program to a new second program using the acquired update data. do. The update control unit 221 stores the acquired update data in the third storage area 243. Details of control of the update process by the update control unit 221 will be described later.
  • the external device is, for example, a server 100 or a device for updating.
  • the providing unit 222 is a processing unit that provides the virtual storage 260 to the ECU 230 by using the storage 23 that realizes the storage unit 240.
  • the providing unit 222 provides the ECU 230 with virtual storage in which the first program stored in the real storage area of the storage 23 is stored, which is accessed from the ECU 230 having the virtual client function. Further, when the update control unit 221 is executing the update process from the first program to the second program, the providing unit 222 is a part of the first program stored in the real storage area of the storage 23. Then, the ECU 230 is provided with virtual storage in which the second program is stored using the update data. Details of the provision process by the provision unit 222 will be described later.
  • the ECU 230 has a control unit 231 and a client unit 232.
  • the control unit 231 is a processing unit that executes the first program or the second program stored in the virtual storage provided by the management ECU 220 to realize the function of the ECU 230. Specifically, the control unit 231 controls the client unit 232 to access the virtual storage provided by the management ECU 220 and execute the first program or the second program stored in the virtual storage.
  • the client unit 232 receives the provision of the first program or the second program stored in the storage unit 240 that functions as virtual storage from the providing unit 222 by exchanging information with the providing unit 222 of the management ECU 220. It is a processing unit.
  • FIG. 5 is a diagram for explaining control of update processing and provision processing. Note that FIG. 5 is a diagram showing a time point during the update process.
  • the update control unit 221 uses the acquired update data for each of the plurality of first partial areas 251 to 255 in which the first storage area 241 in which the first program is stored is divided into a plurality of the first storage areas 241.
  • the first partial program stored in the partial area is updated to the second partial program which is a part of the new second program.
  • the update control unit 221 selects the first subregions to be processed one by one from the plurality of first subregions 251 to 255 in a predetermined order. Then, the update control unit 221 copies the first partial program stored in the first partial area of the selected processing target to the second storage area 242.
  • the update control unit 221 applies the update data to the first partial program stored in the first partial area of the processing target to generate the second partial program, and the first of the first partial area of the processing target.
  • the first subprogram is updated to the second subprogram by rewriting the subprogram with the generated second subprogram.
  • the predetermined order may be, for example, the access order in the storage 23.
  • the plurality of first partial areas 251 to 255 may be storage areas that are continuously arranged in the real storage area of the storage 23, or the first partial areas may be adjacent to the first partial area.
  • the storage areas may be arranged at intervals of predetermined storage areas. When the predetermined storage areas are arranged at intervals, the free area or data indicating the free area may be stored in the predetermined storage area between the predetermined storage areas and the adjacent first partial areas.
  • the predetermined storage area stores the second partial program that could not be stored in the first partial area 251 when the updated second partial program has an amount of data exceeding the storage capacity of the first partial area 251. May be good.
  • the predetermined storage area used in this case may be a storage area arranged adjacent to the first partial area 251.
  • the above can be applied when the storage 23 is realized by an HDD or the like in which a recording medium that is sequentially accessed is used. This is not the case when the storage 23 is realized by a non-volatile memory such as an SDD that is randomly accessed.
  • the region may include a plurality of regions other than five, not limited to the inclusion of five regions.
  • the first partial program is a partial program stored in each of a plurality of first partial areas 251 to 255 of the first program.
  • the first partial program is code stored in the corresponding first partial area among the codes constituting the first program.
  • the first program is stored (across) over a plurality of first subregions 251 to 255 constituting the first storage area 241.
  • the first program does not function without all the plurality of first partial programs constituting the first program.
  • the second part program is a part of the second program, and is a partial program generated by applying update data to each of a plurality of first part programs.
  • the second subprogram is a code generated by updating the first subprogram corresponding to the second subprogram among the codes constituting the second program using the update data.
  • FIG. 6 is a diagram for explaining a detailed example of the update process according to the embodiment.
  • FIG. 6A shows the relationship between the plurality of first data units D1 to D4 constituting the first partial program and the addresses (positions) on the data constituting the first partial program of each first data unit. It is a figure.
  • FIG. 6B shows the plurality of second data units D1, D2, D5, and D6 constituting the second subprogram and the addresses (positions) on the data constituting the second subprogram of each second data unit. It is a figure which shows the relationship of.
  • the address on the program may be indicated by, for example, a relative value (offset value) from a predetermined reference address (for example, the start address of the program, an absolute value).
  • a relative value offset value
  • the address x1 on the first partial program of the first data unit D2 may be calculated by the reference address x0 and the data length L1 of the first data unit D1 stored before the first data unit D2. good. That is, the address x1 may be calculated by adding the data length L1 to the reference address x0.
  • FIG. 6C is a diagram showing the structure of update data.
  • the update data includes a plurality of difference data and correspondence information.
  • the update data may further include a plurality of difference data and a number (sequence number) for specifying the correspondence information thereof.
  • the plurality of difference data is the difference between the plurality of first data units D1 to D4 constituting the first partial program and the plurality of second data units D1, D2, D5, D6 constituting the second partial program. It is the data which shows.
  • the correspondence information includes an address on the first partial program of the first data unit corresponding to each of the plurality of difference data, and an address on the second partial program of the second data unit corresponding to each of the plurality of difference data. including. That is, the correspondence information is information for specifying the first data unit and the second data unit corresponding to each difference data.
  • the correspondence relationship information shows the first data unit of the first subprogram and the second data unit of the second subprogram that are in a correspondence relationship.
  • the update control unit 221 can generate the second data unit D1 by adding 0 as the difference data to the first data unit D1 arranged at the address x0 on the data of the first subprogram.
  • the correspondence information of the number 02 indicates that there is no address corresponding to the first subprogram and the address corresponding to the second subprogram is x1.
  • the second data unit D5 represented by the difference data at the address x1 is inserted after the second data unit D1 of the previous number 01. That is, the update control unit 221 identifies the address x1 by adding the data length L1 of the second data unit D1 generated last time to the address x0 of the second data unit D1 generated last time, and assigns the address x1 to the specified address x1.
  • the data unit D5 indicated by the difference data in the number 02 is inserted.
  • the update control unit 221 can generate the second data unit D5 at the address x1 on the data of the second subprogram.
  • the first data unit D4 arranged at the address x3 on the data of the first subprogram and the second data unit D6 arranged at the address x6 on the data of the second subprogram It is shown that there is a correspondence between and. Since the difference data of the number 04 is D6-D4 which is not 0, it is shown that the first data unit D4 and the second data unit D6 are different data units. That is, the update control unit 221 specifies the address x6 by adding the data length L2 of the second data unit D2 generated last time to the address x5 of the second data unit D2 generated last time. The update control unit 221 generates the second data unit D6 by adding the difference data D6-D4 in the number 04 to the first data unit D4, and the generated second data unit D6 is assigned to the specified address x6. Deploy.
  • the address x3 on the data of the first subprogram is shown, and the address x3 is arranged in the order of the addresses x0 to x3 of the first data units D1 to D4 of the first subprogram.
  • the address x2 immediately before is skipped. This indicates that the first data unit D3 at the address x3 is deleted. Therefore, the update control unit 221 deletes the first data unit D3 of the first subprogram.
  • the update control unit 221 may store the deleted first data unit D3 in the third storage area 243.
  • the update control unit 221 generated the second partial program by applying the update data to the first partial program, and generated the first partial program stored in the first partial area.
  • the first part program is updated to the second part program.
  • the amount of difference data is small. Therefore, the amount of update data can be made smaller than that of the second subprogram.
  • the difference between the first part program and the second part program can be obtained by using the binary difference algorithm.
  • the correspondence information is not limited to the information shown in FIG. 6C, but is based on data indicating the processing content (addition, insertion, deletion) of the difference data and the data length of the processing target in the processing content. It may be calculated. Thereby, the address of the first data unit and the address of the second data unit shown in FIG. 6C can be specified.
  • first and second subprograms have been described in FIG. 6, the first program and the first program and the second program can be read by replacing the first subprogram with the first program and the second subprogram with the second program.
  • the second program can be described in the same manner.
  • the updating control unit 221 When the update control unit 221 receives access to the virtual storage 260 from the ECU 230 while the update control unit 221 is updating the first program, the providing unit 222 responds to the update status of the first partial areas 251 to 255 of the access destination. , A new second program is provided to the ECU 230 by performing any of the three processes shown below. That is, the update control unit 221 performs different processes according to the three update states (after the update process, during the update process, and before the update process).
  • the providing unit 222 provides the ECU 230 with the second partial program stored in the first partial area 251. In this case, the providing unit 222 has already updated the program stored in the accessed first partial area 251 to the second partial program, so that the updated second partial program stored in the first partial area 251 is used. Provided to ECU 230.
  • the providing unit 222 includes the first partial program stored in the second storage area 242 and the first portion of the update data.
  • a second partial program in which the first partial program is updated is generated using the partial data corresponding to the program, and the generated second partial program is provided to the ECU 230.
  • the providing unit 222 since the program stored in the accessed first partial area 251 is being updated, the providing unit 222 sends the first partial program saved in the second storage area 242 during the update process.
  • the second partial program is generated by applying the partial data corresponding to the first partial program among the update data stored in the third storage area 243. That is, in this case, the providing unit 222 generates a second partial program each time it is accessed, and provides the generated second partial program to the ECU 230.
  • the providing unit 222 includes the first partial program stored in the first partial area and the update data.
  • a second partial program in which the first partial program is updated is generated by using the partial data corresponding to the first partial program, and the generated second partial program is provided to the ECU 230.
  • the providing unit 222 since the program stored in the accessed first partial area 251 is before the update process, the providing unit 222 stores the third storage area in the first partial program stored in the first partial area.
  • the partial data corresponding to the first partial program is applied to generate the second partial program. That is, in this case, the providing unit 222 generates a second partial program each time it is accessed, and provides the generated second partial program to the ECU 230.
  • the providing unit 222 performs processing according to the update state of the first partial area of the access destination. Therefore, the providing unit 222 can provide the updated second program to the ECU 230 even while the process of updating the first program to the second program is being performed.
  • the providing unit 222 generates a second partial program each time it is accessed, but the present invention is not limited to this.
  • the providing unit 222 when it is accessed for the first time, temporarily holds the generated second partial program in the storage unit 240, and is accessed for the second time or later.
  • the second partial program temporarily held may be provided to the ECU 230. In this case, since the providing unit 222 only needs to generate the second partial program once, the processing load can be reduced.
  • the providing unit 222 may determine whether or not to temporarily hold the second part program in the storage unit 240 according to, for example, the access frequency by the ECU 230. In this case, the providing unit 222 temporarily holds the number of accesses to each first partial program by the ECU 230 in the storage unit 240, and generates when the number of accesses reaches a preset number of accesses. The second part program is temporarily held in the storage unit 240, and when the number of accesses by the ECU 230 does not reach the preset number of accesses, the generated second part program is temporarily held in the storage unit 240. It does not have to be.
  • FIG. 7 is a diagram for explaining a first example of processing when the update processing fails.
  • the update control unit 221 may store the update states of the plurality of first subregions 251 to 255 in the storage unit 240.
  • the update state includes three states: after the update process (update completed), during the update, and before the update process (unprocessed).
  • the update control unit 221 when the update control unit 221 fails to update the first partial program in the first partial region 254, as shown in FIG. 7 (b), all the plurality of orders. For the 1 subregions 251 to 255, the first subprogram stored in the first subregion is updated to the second subprogram. That is, the update control unit 221 continuously updates the first partial program stored in the unprocessed first partial area to the second partial program even when the update fails.
  • the update method is as described with reference to FIGS. 5 and 6.
  • the update control unit 221 updates each of the plurality of first partial areas 251 to 255 in which the first storage area 241 in which the second program is stored is divided after updating the first program to the second program.
  • the second partial program stored in the first partial area is updated to the first partial program which is a part of the original first partial program by using the update data stored in the third storage area 243. ..
  • the update control unit 221 performs this process in the same manner as the process of updating the first program to the second program. That is, in the control of the update process by the update control unit 221, the first program is the second program, the second program is the first program, the first part program is the second part program, and the second part program is the first part. It can be explained by reading each program. The same applies to the provision process by the provision unit 222 at this time.
  • the update control unit 221 when updating the second subprogram to the original first subprogram, the update control unit 221 is supposed to update using the update data stored in the third storage area 243, but the present invention is not limited to this.
  • the update data stored in the third storage area 243 is data that cannot be applied to the update process of returning the second subprogram to the original first subprogram
  • the update control unit 221 may or may not be able to apply the update data to the original first subprogram.
  • the amount of processing required for the update process to be returned is larger than the predetermined amount of processing (for example, the amount of processing required for the update process from the first subprogram to the second subprogram), it is restored using new update data.
  • the update process may be performed. In this case, the update control unit 221 acquires new update data for the update process of returning the second subprogram to the original first subprogram from the external device.
  • FIG. 8 is a diagram for explaining a second example of processing when the update processing fails.
  • the update control unit 221 when the update control unit 221 fails to update the first partial program in the first partial region 252, the update control unit 221 has updated one or more as shown in FIG. 8B.
  • the update is performed for each of the first partial area 251 and the first partial area 252 for which the update failed, after copying the second partial program stored in the first partial area to the second storage area 242, the update is performed.
  • the second partial program is updated to the first partial program by using the partial data corresponding to the second partial program in the data.
  • the update control unit 221 performs this process in the same manner as the process of updating the first program to the second program. The same applies to the provision process by the provision unit 222 at this time.
  • the third example is an example in which the processing of the first example and the processing of the second example are switched according to the position of the first partial region where the failure has occurred.
  • the update control unit 221 identifies the first subregions for which the update failed from among a plurality of first subregions 251 to 255. From the first subregion 253 of the above, it is determined whether it is before or after in the processing order. Then, the update control unit 221 performs the process of the second example described with reference to FIG. 8 when the first subregion in which the update failed as a result of the determination is before the specific first subregion 253 in the processing order. .. On the other hand, when the update control unit 221 determines that the first subregion in which the update failed is later than the specific first subregion 253 in the processing order, the update control unit 221 performs the processing of the first example described with reference to FIG. conduct.
  • the update control unit 221 may perform the processing of the first example, or the second. You may perform the processing of the example of. In this case, whether to perform the processing of the first example or the processing of the second example may be predetermined, and the update control unit 221 processes the processing of the first example and the processing of the second example. Performs a predetermined process.
  • the specific first partial region is the first partial region 253 of the plurality of first partial regions 251 to 255, it is not limited to the first partial region 253.
  • the specific first partial region may be a predetermined first partial region among the plurality of first partial regions.
  • FIG. 9 is a flowchart showing an example of the update process by the information processing apparatus 210 according to the embodiment.
  • the management ECU 220 determines whether or not the update data has been acquired (S11).
  • the management ECU 220 determines that the update data has been acquired (Yes in S11)
  • the management ECU 220 performs loop 1 including the following steps S12 and S13 for each of the plurality of first partial regions 251 to 255.
  • the management ECU 220 determines that the update data has not been acquired (No in S11)
  • the management ECU 220 returns to step S11.
  • the management ECU 220 copies the first partial program stored in the first partial area to be processed to the second storage area 242 (S12).
  • the management ECU 220 updates the first partial program stored in the first partial area to be processed to the second partial program by using the partial data corresponding to the first partial program among the update data (the partial data corresponding to the first partial program is used). S13).
  • FIG. 10 is a flowchart showing an example of the provision process by the information processing apparatus 210 according to the embodiment.
  • the management ECU 220 determines whether or not the ECU 230 has received access to the virtual storage 260 (S21).
  • the management ECU 220 determines that the ECU 230 has accepted the access to the virtual storage 260 (Yes in S21), the management ECU 220 determines the update state of the first partial area of the access destination (S22). When the management ECU 220 determines that the ECU 230 is not accepting access to the virtual storage 260 (No in S21), the management ECU 220 returns to step S21.
  • the management ECU 220 performs step S23 when the update status of the first partial area of the access destination indicates that the update process has been completed (update completed) (update completed in S22).
  • the management ECU 220 performs step S24.
  • the management ECU 220 performs step S26.
  • step S23 the management ECU 220 provides the ECU 230 with a second partial program stored in the first partial area of the access destination (S23).
  • step S24 the management ECU 220 generates a second partial program using the first partial program stored in the second storage area 242 and the difference data corresponding to the first partial program (S24). Then, the management ECU 220 provides the generated second partial program to the ECU 230 (S25).
  • step S26 the management ECU 220 generates a second partial program using the first partial program stored in the first partial region of the access destination and the difference data corresponding to the first partial program (S26). ). Then, the management ECU 220 provides the generated second partial program to the ECU 230 (S27).
  • FIG. 11 is a flowchart showing a first example of rollback processing by the information processing apparatus 210 according to the embodiment.
  • the management ECU 220 determines whether or not the update has failed during the update process (S31). For example, in the process of step S31, the management ECU 220 may have damage to the update data, a non-writable area due to physical deterioration of the storage unit 240, or an abnormal interruption of the update process. In addition, it is determined that the update has failed.
  • the management ECU 220 can determine that the update data has been damaged, for example, when the update data cannot be acquired from the storage unit 240 or when the update data cannot be applied to the update process. For example, when an error is detected during the update process, the management ECU 220 can determine that a non-writable area has occurred in the storage unit 240 due to physical deterioration or the like. For example, when an error is detected during the update process, the management ECU 220 can determine that an abnormal interruption of the update process has occurred when the contents of the written program after the update process is restarted are confirmed.
  • the management ECU 220 may fail to update in the following cases.
  • a risk of update failure for example, when a sudden power failure occurs when receiving update data, or when a non-writable area occurs due to physical deterioration of the storage 23, the non-writable area is entered.
  • access before error check occurs, or when the processing load exceeds a predetermined load.
  • the management ECU 220 determines whether or not there is a first partial area during the update process (S32). On the other hand, when the management ECU 220 determines that the update has not failed during the update process (No in S31), the management ECU 220 returns to step S31. In this case, the update process described with reference to FIG. 9 is continued.
  • the management ECU 220 determines that there is a first partial area during the update process (Yes in S32), the management ECU 220 stores the first partial program stored in the second storage area 242 in the first partial area during the update process. (S33).
  • the area being updated can be reliably written back to the first subprogram, and the next process can be reliably executed.
  • the management ECU 220 determines whether or not there is a first partial area during the update process (No in S32), or after step S33 and before the update process (unprocessed). (S34).
  • the management ECU 220 determines that there is a first partial area before the update process (Yes in S34), the management ECU 220 performs a loop 2 including the following steps S35 and S36 for each of the first partial areas before the update process.
  • the management ECU 220 copies the first partial program stored in the first partial area to be processed to the second storage area 242 (S35).
  • the management ECU 220 updates the first partial program stored in the first partial area to be processed to the second partial program by using the partial data corresponding to the first partial program among the update data (the partial data corresponding to the first partial program is used). S36).
  • the management ECU 220 copies the second partial program stored in the first partial area to be processed to the second storage area 242 (S37).
  • the management ECU 220 updates the second partial program stored in the first partial area to be processed to the first partial program by using the partial data corresponding to the second partial program among the update data (the secondary partial program). S38).
  • FIG. 12 is a flowchart showing a second example of rollback processing by the information processing apparatus 210 according to the embodiment.
  • the management ECU 220 performs the same processing as in steps S31 to S33.
  • a loop 4 including the following steps S41 and S42 is performed.
  • the management ECU 220 copies the second partial program stored in the first partial area to be processed to the second storage area 242 (S41).
  • the management ECU 220 updates the second partial program stored in the first partial area to be processed to the first partial program by using the partial data corresponding to the second partial program among the update data (the secondary partial program). S42).
  • step S41 and step S41 for all the updated first partial areas and the first partial area for which the update has failed the process ends.
  • FIG. 13 is a flowchart showing a third example of rollback processing by the information processing apparatus 210 according to the embodiment.
  • the management ECU 220 performs the same processing as in steps S31 to S33.
  • the management ECU 220 determines that there is no first partial region during the update process (No in S32), or after step S33, the first partial region for which the update failed is a plurality of first partial regions 251 to 255. From the specific first partial region 253, it is determined whether it is before or after in the processing order (S51).
  • the update is performed.
  • a loop 4 including the following steps S41 and S42 is performed for each of the one or more first subregions that have been completed and the first subregion that has failed to be updated. Since the loop 4 has already been described with reference to FIG. 12, the description thereof will be omitted.
  • the management ECU 220 determines that the first partial region for which the update has failed is later in the processing order than the specific first partial region 253 of the plurality of first partial regions 251 to 255 (after in S51), the step.
  • the same processing as in steps S34 to S38 is performed.
  • the first partial program is saved by copying the first partial program stored in the first partial area to be updated to the second storage area 242. Then, the first partial program stored in the first partial area is updated to the second partial program. Therefore, even when the first partial area during the update process is accessed, the saved first partial program can be used instead of the first partial program during the update process, and the access source device can be used. A program can be provided. Further, since the data used for the update is the difference information and the program to be saved is the first part program of a part of the first program, the storage capacity of the storage used at the time of updating the program can be reduced. ..
  • the information processing device 210 includes an ECU 230, an update control unit 221 and a management ECU 220 having a storage unit 240 as a virtual storage 260 and a providing unit 222.
  • 1 program is a program executed by the ECU 230 at startup. That is, since the first program executed by the ECU 230 is stored in the virtual storage 260 provided by the management ECU 220, the program of the ECU 230 can be updated without using the ECU 230. Therefore, the program of the ECU 230 to be updated can be updated so as not to affect the operation of the ECU 230.
  • the difference information is a difference between a plurality of first data units constituting the first program and a plurality of second data units constituting the second program.
  • the plurality of difference data to be shown and the correspondence information for specifying the first data unit and the second data unit corresponding to the difference data are included in each of the plurality of difference data. Therefore, the first data unit to which the difference data is applied can be easily specified. Therefore, the processing load related to the generation process of the second subprogram and the processing time related to the generation process can be reduced.
  • Modification example 1 (Modification example 1)
  • the management ECU 220 and the ECU 230 are realized by any one of n ECUs 22, but the present invention is not limited to this, and one or more processors and a virtualized environment are realized. It may be realized by the memory or storage in which the program for the purpose is stored.
  • FIG. 14 is a block diagram showing an example of the functional configuration of the information processing device 210A according to the first modification.
  • FIG. 15 is a diagram showing a configuration of a virtual machine that realizes the function of the information processing device 210A according to the first modification.
  • the information processing device 210A includes a management VM (Virtual Machine) 220A, a plurality of VMs (Virtual Machine) 230Aa and 230Ab, and a shared memory 250.
  • the information processing device 210A has a virtual machine virtually realized by software on one or more hardware.
  • the information processing device 210A is realized in a hypervisor type virtual environment.
  • the management VM 220A has the same function as the management ECU 220 according to the embodiment.
  • the plurality of VM230Aa and 230Ab have the same functions as the ECU 230 according to the embodiment.
  • the shared memory 250 provides a storage area by the virtual storage function. In this way, since the storage area of the program of each VM is realized by the shared memory 250, information can be exchanged between the management VM 220A and the VM 230Aa and 230Ab at high speed.
  • the automobile 200 is given as an example of the moving body, but the moving body is not limited to the automobile 200, but may be another vehicle, an unmanned vehicle, a flying object such as a drone, or the like. There may be.
  • the information processing device 210 is not limited to, for example, a computer system mounted on a mobile body, and may be applied to any computer system as long as it has a plurality of controls.
  • each component may be configured by dedicated hardware or may be realized by executing a software program suitable for each component.
  • Each component may be realized by a program execution unit such as a CPU or a processor reading and executing a software program recorded on a recording medium such as a hard disk or a semiconductor memory.
  • the software that realizes the program update method of each of the above embodiments is the following program.
  • this program is an information processing method executed by an information processing device including a storage unit in which the first program is stored in a computer, and acquires data for updating the first program from an external device.
  • the first program is updated to a new second program using the acquired data, and in the update, the first storage area, which is the storage area of the storage unit in which the first program is stored, is divided.
  • the first partial program which is a part of the first program stored in the first partial area, is copied to a second storage area different from the first storage area.
  • the first partial program is sequentially updated to the second partial program which is a part of the second program by using the partial data corresponding to the first partial program in the data, and the data is obtained as described above. It is the difference information indicating the difference between the first program and the second program, and the storage capacity of the second storage area is smaller than the storage capacity of the first storage area to execute an information processing method.
  • the present disclosure is applicable to an information processing device or the like that can update the program of the control to be updated so as not to affect the control.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Software Systems (AREA)
  • Computer Security & Cryptography (AREA)
  • Quality & Reliability (AREA)
  • Computer Hardware Design (AREA)
  • Stored Programmes (AREA)
  • Information Transfer Between Computers (AREA)

Abstract

An information processing device (210) includes: a storage unit (240) that stores a first program; and an update control unit (221) that updates the first program to a new second program using data acquired from an external device, and for each of a plurality of first subareas (251 to 255) divided from a first storage area (241) storing the first program, the update control unit (221) copies a first portion program to a second storage area (242), the first portion program being a portion of the first program stored in the first subarea, and then sequentially updates the first portion program to a second portion program using data, the second portion program being a portion of a second program, data being difference information indicating the difference between the first program and the second program, and the storage capacity of the second storage area (242) is lower than the storage capacity of the first storage area (241).

Description

情報処理装置および情報処理方法Information processing device and information processing method
　本開示は、情報処理装置および情報処理方法に関する。 This disclosure relates to an information processing device and an information processing method.
　特許文献１には、旧情報から新情報に書き換える際に、メモリに蓄積されている旧情報を当該メモリとは別のメモリに退避させる電子制御装置が開示されている。 Patent Document 1 discloses an electronic control device that saves old information stored in a memory to a memory different from the memory when rewriting the old information to new information.
特開２０１９－７４８４７号公報JP-A-2019-74847
　本開示は、プログラムの更新時に使用するストレージの記憶容量を低減することができる情報処理装置などを提供する。 The present disclosure provides an information processing device and the like that can reduce the storage capacity of the storage used when updating a program.
　本開示における情報処理装置は、第１プログラムが格納されている記憶部と、外部装置から前記第１プログラムの更新用のデータを取得し、取得した前記データを用いて前記第１プログラムを新たな第２プログラムに更新する更新制御部と、を備え、前記更新制御部は、前記第１プログラムが格納されている前記記憶部の記憶領域である第１記憶領域が分割された複数の第１部分領域のそれぞれについて、当該第１部分領域に格納されている前記第１プログラムの一部である第１部分プログラムを前記第１記憶領域とは異なる第２記憶領域にコピーした後で、前記データのうちで前記第１部分プログラムに対応する部分データを用いて前記第１部分プログラムを前記第２プログラムの一部である第２部分プログラムに順次更新し、前記データは、前記第１プログラムと前記第２プログラムとの間の差分を示す差分情報であり、前記第２記憶領域の記憶容量は、前記第１記憶領域の記憶容量よりも小さい。 The information processing device in the present disclosure acquires data for updating the first program from a storage unit in which the first program is stored and an external device, and uses the acquired data to newly use the first program. The update control unit includes an update control unit for updating to a second program, and the update control unit is a plurality of first portions in which a first storage area, which is a storage area of the storage unit in which the first program is stored, is divided. For each of the areas, after copying the first partial program, which is a part of the first program stored in the first partial area, to a second storage area different from the first storage area, the data The first partial program is sequentially updated to the second partial program which is a part of the second program by using the partial data corresponding to the first partial program, and the data is the first program and the first program. It is the difference information indicating the difference between the two programs, and the storage capacity of the second storage area is smaller than the storage capacity of the first storage area.
　なお、これらの全般的または具体的な態様は、システム、方法、集積回路、コンピュータプログラムまたはコンピュータ読み取り可能なＣＤ－ＲＯＭなどの記録媒体で実現されてもよく、システム、方法、集積回路、コンピュータプログラムおよび記録媒体の任意な組み合わせで実現されてもよい。 It should be noted that these general or specific embodiments may be realized in a recording medium such as a system, method, integrated circuit, computer program or computer readable CD-ROM, system, method, integrated circuit, computer program. And any combination of recording media may be realized.
　本開示における情報処理装置などは、プログラムの更新時に使用するストレージの記憶容量を低減することができる。 The information processing device and the like in the present disclosure can reduce the storage capacity of the storage used when updating the program.
図１は、実施の形態に係る自動車への更新用のプログラムを配信するシステムの概略図である。FIG. 1 is a schematic diagram of a system for delivering a program for updating to an automobile according to an embodiment. 図２は、実施の形態に係るサーバのハードウェア構成の一例を示すブロック図である。FIG. 2 is a block diagram showing an example of the hardware configuration of the server according to the embodiment. 図３は、実施の形態に係る自動車が備える情報処理装置のハードウェア構成の一例を示すブロック図である。FIG. 3 is a block diagram showing an example of the hardware configuration of the information processing device included in the automobile according to the embodiment. 図４は、実施の形態に係る情報処理装置の機能構成の一例を示すブロック図である。FIG. 4 is a block diagram showing an example of the functional configuration of the information processing apparatus according to the embodiment. 図５は、実施の形態に係る更新処理の制御、および、提供処理について説明するための図である。FIG. 5 is a diagram for explaining control of update processing and provision processing according to the embodiment. 図６は、実施の形態に係る更新処理の詳細の一例について説明するための図である。FIG. 6 is a diagram for explaining a detailed example of the update process according to the embodiment. 図７は、実施の形態に係る更新処理が失敗した場合の処理の第１の例について説明するための図である。FIG. 7 is a diagram for explaining a first example of processing when the update processing according to the embodiment fails. 図８は、実施の形態に係る更新処理が失敗した場合の処理の第２の例について説明するための図である。FIG. 8 is a diagram for explaining a second example of processing when the update processing according to the embodiment fails. 図９は、実施の形態に係る情報処理装置による更新処理の一例を示すフローチャートである。FIG. 9 is a flowchart showing an example of the update process by the information processing apparatus according to the embodiment. 図１０は、実施の形態に係る情報処理装置による提供処理の一例を示すフローチャートである。FIG. 10 is a flowchart showing an example of the provision process by the information processing apparatus according to the embodiment. 図１１は、実施の形態に係る情報処理装置によるロールバック処理の第１の例を示すフローチャートである。FIG. 11 is a flowchart showing a first example of rollback processing by the information processing apparatus according to the embodiment. 図１２は、実施の形態に係る情報処理装置によるロールバック処理の第２の例を示すフローチャートである。FIG. 12 is a flowchart showing a second example of rollback processing by the information processing apparatus according to the embodiment. 図１３は、実施の形態に係る情報処理装置によるロールバック処理の第３の例を示すフローチャートである。FIG. 13 is a flowchart showing a third example of rollback processing by the information processing apparatus according to the embodiment. 図１４は、変形例１に係る情報処理装置の機能構成の一例を示すブロック図である。FIG. 14 is a block diagram showing an example of the functional configuration of the information processing apparatus according to the first modification. 図１５は、変形例１に係る情報処理装置の機能を実現する仮想マシンの構成を示す図である。FIG. 15 is a diagram showing a configuration of a virtual machine that realizes the function of the information processing device according to the first modification.
　（本発明の基礎となった知見）
　本発明者は、「背景技術」の欄において記載した、電子制御装置に関し、以下の問題が生じることを見出した。 (Knowledge that became the basis of the present invention)
The present inventor has found that the following problems arise with respect to the electronic control device described in the "Background Technology" column.
　特許文献１の電子制御装置では、旧情報から新情報に書き換える際に、メモリに蓄積されている旧情報を当該メモリとは別のメモリに退避させるため、旧情報を記憶できるだけの記憶容量を有する別のメモリが必要となる。あるいは、同じメモリに旧情報を退避するとしても、旧情報のコピーを記憶できるだけの記憶容量を余分に有するメモリが必要となる。このため、別のメモリまたは大容量のメモリが必要となる。 The electronic control device of Patent Document 1 has a storage capacity capable of storing the old information because the old information stored in the memory is saved in a memory different from the memory when the old information is rewritten to the new information. Separate memory is required. Alternatively, even if the old information is saved in the same memory, a memory having an extra storage capacity capable of storing a copy of the old information is required. Therefore, another memory or a large amount of memory is required.
　このような課題を解決するために、発明者らは、プログラムの更新時に使用するストレージの記憶容量を低減することができる情報処理装置および情報処理方法を見出すに至った。 In order to solve such a problem, the inventors have found an information processing device and an information processing method capable of reducing the storage capacity of the storage used when updating the program.
　本開示の一態様に係る情報処理装置は、第１プログラムが格納されている記憶部と、外部装置から前記第１プログラムの更新用のデータを取得し、取得した前記データを用いて前記第１プログラムを新たな第２プログラムに更新する更新制御部と、を備え、前記更新制御部は、前記第１プログラムが格納されている前記記憶部の記憶領域である第１記憶領域が分割された複数の第１部分領域のそれぞれについて、当該第１部分領域に格納されている前記第１プログラムの一部である第１部分プログラムを前記第１記憶領域とは異なる第２記憶領域にコピーした後で、前記データのうちで前記第１部分プログラムに対応する部分データを用いて前記第１部分プログラムを前記第２プログラムの一部である第２部分プログラムに順次更新し、前記データは、前記第１プログラムと前記第２プログラムとの間の差分を示す差分情報であり、前記第２記憶領域の記憶容量は、前記第１記憶領域の記憶容量よりも小さい。 The information processing device according to one aspect of the present disclosure acquires data for updating the first program from a storage unit in which the first program is stored and an external device, and uses the acquired data to obtain the first program. The update control unit includes an update control unit that updates the program to a new second program, and the update control unit is a plurality of divided first storage areas that are storage areas of the storage unit in which the first program is stored. After copying the first partial program, which is a part of the first program stored in the first partial area, to a second storage area different from the first storage area for each of the first partial areas of the above. , The first partial program is sequentially updated to the second partial program which is a part of the second program by using the partial data corresponding to the first partial program among the data, and the data is the first. It is the difference information indicating the difference between the program and the second program, and the storage capacity of the second storage area is smaller than the storage capacity of the first storage area.
　これによれば、更新処理の対象となる第１部分領域に格納されている第１部分プログラムを第２記憶領域にコピーすることで、第１部分プログラムを退避させた上で、当該第１部分領域に格納されている第１部分プログラムを第２部分プログラムに更新する。このため、更新処理中の第１部分領域にアクセスされた場合であっても、更新処理中の第１部分プログラムの代わりに退避させた第１部分プログラムを用いることができ、アクセス元の機器にプログラムを提供することができる。また、更新に用いられるデータは差分情報であり、かつ、退避させるプログラムは第１プログラムの一部の第１部分プログラムであるため、プログラムの更新時に使用するストレージの記憶容量を低減することができる。 According to this, the first part program is saved by copying the first part program stored in the first part area to be updated to the second storage area, and then the first part is saved. The first subprogram stored in the area is updated to the second subprogram. Therefore, even when the first partial area during the update process is accessed, the saved first partial program can be used instead of the first partial program during the update process, and the access source device can be used. A program can be provided. Further, since the data used for the update is the difference information and the program to be saved is the first part program of a part of the first program, the storage capacity of the storage used at the time of updating the program can be reduced. ..
　また、さらに、第１制御器と、前記更新制御部と、前記記憶部を仮想ストレージとして前記第１制御器に提供する提供部とを有する第２制御器と、を備え、前記第１プログラムは、前記第１制御器が起動時に実行するプログラムであってもよい。 Further, the first program includes a first controller, an update control unit, and a second controller having a supply unit that provides the storage unit as virtual storage to the first control unit. , The program may be executed by the first controller at startup.
　これによれば、第１制御器が実行する第１プログラムは、第２制御器が提供する仮想ストレージに格納されているため、第１制御器のプログラムの更新を、第１制御器を用いずに行うことができる。よって、更新対象の第１制御器のプログラムを第１制御器に影響を与えないように更新することができる。 According to this, since the first program executed by the first control is stored in the virtual storage provided by the second control, the program of the first control is updated without using the first control. Can be done. Therefore, the program of the first control to be updated can be updated so as not to affect the first control.
　また、前記提供部は、前記更新制御部が前記第１プログラムを更新している間において、前記第１制御器から前記仮想ストレージへのアクセスを受け付けた場合、（ｉ）前記アクセスのアクセス先が更新処理後の第１部分領域であれば、当該第１部分領域に格納されている前記第２部分プログラムを前記第１制御器に提供し、（ｉｉ）前記アクセス先が更新処理中の第１部分領域であれば、前記第２記憶領域に格納されている第１部分プログラムと、前記データのうちで当該第１部分プログラムに対応する部分データとを用いて、当該第１部分プログラムを更新した第２部分プログラムを生成し、生成した前記第２部分プログラムを前記第１制御器に提供し、（ｉｉｉ）前記アクセス先が更新処理前の第１部分領域であれば、当該第１部分領域に格納されている第１部分プログラムと、前記データのうちで当該第１部分プログラムに対応する部分データとを用いて、当該第１部分プログラムを更新した第２部分プログラムを生成し、生成した前記第２部分プログラムを前記第１制御器に提供してもよい。 Further, when the providing unit receives access to the virtual storage from the first control while the update control unit is updating the first program, (i) the access destination of the access is If it is the first partial area after the update process, the second partial program stored in the first partial area is provided to the first controller, and (ii) the first access destination is in the process of updating. If it is a partial area, the first partial program is updated by using the first partial program stored in the second storage area and the partial data corresponding to the first partial program in the data. A second partial program is generated, and the generated second partial program is provided to the first controller. (Iii) If the access destination is the first partial region before the update process, the first partial region is used. Using the stored first partial program and the partial data corresponding to the first partial program in the data, a second partial program in which the first partial program is updated is generated, and the generated first portion program is generated. A two-part program may be provided to the first controller.
　これによれば、アクセス先の第１部分領域の更新状態に応じた処理を行うため、第１プログラムから第２プログラムへの更新処理中であっても第１制御器へ第２プログラムを提供することができる。 According to this, in order to perform processing according to the update state of the first partial area of the access destination, the second program is provided to the first control even during the update processing from the first program to the second program. be able to.
　また、前記差分情報は、前記第１プログラムを構成する複数の第１データ単位、および、第２プログラムを構成する複数の第２データ単位の間の差分を示す複数の差分データと、前記複数の差分データ毎に、当該差分データに対応する前記第１データ単位及び前記第２データ単位を特定するための対応関係情報とを含んでもよい。 Further, the difference information includes a plurality of first data units constituting the first program, a plurality of difference data indicating a difference between a plurality of second data units constituting the second program, and the plurality of difference data. Each difference data may include the first data unit corresponding to the difference data and the correspondence information for specifying the second data unit.
　このため、差分データを適用する第１データ単位を容易に特定することができる。よって、第２部分プログラムの生成処理に係る処理負荷、および、当該生成処理に係る処理時間を低減することができる。 Therefore, the first data unit to which the difference data is applied can be easily specified. Therefore, the processing load related to the generation process of the second subprogram and the processing time related to the generation process can be reduced.
　また、前記更新制御部は、前記第１プログラムを更新している間に当該更新が失敗した場合、全ての前記複数の第１部分領域について、当該第１部分領域に格納されている前記第１部分プログラムを前記第２部分プログラムに更新し、前記第１プログラムを前記第２プログラムに更新した後で、前記第２プログラムが格納されている前記第１記憶領域が分割された前記複数の第１部分領域のそれぞれについて、当該第１部分領域に格納されている前記第２プログラムの一部である前記第２部分プログラムを前記第２記憶領域にコピーし、当該コピーの後で、前記データのうちで前記第２部分プログラムに対応する部分データを用いて前記第２部分プログラムを前記第１プログラムの一部である第１部分プログラムに更新してもよい。 Further, when the update fails while updating the first program, the update control unit stores the first plurality of first partial areas in the first partial area. After updating the partial program to the second partial program and updating the first program to the second program, the plurality of first storage areas in which the second program is stored are divided. For each of the partial areas, the second partial program, which is a part of the second program stored in the first partial area, is copied to the second storage area, and after the copy, of the data The second partial program may be updated to the first partial program which is a part of the first program by using the partial data corresponding to the second partial program.
　これにより、更新処理中において第１プログラムから第２プログラムへの更新が失敗した場合であっても、第１記憶領域に第１プログラムが格納されている状態に戻すことができる。 As a result, even if the update from the first program to the second program fails during the update process, it is possible to return to the state in which the first program is stored in the first storage area.
　また、前記更新制御部は、前記第１プログラムを更新している間に当該更新が失敗した場合、更新済みの１以上の前記第１部分領域と、更新が失敗した第１部分領域とのそれぞれについて、当該第１部分領域に格納されている第２プログラムの一部である第２部分プログラムを前記第２記憶領域にコピーした後で、前記データのうちで前記第２部分プログラムに対応する部分データを用いて前記第２部分プログラムを前記第１部分プログラムに更新してもよい。 Further, when the update fails while the update control unit is updating the first program, the update control unit includes one or more updated first partial areas and the updated first partial area, respectively. After copying the second partial program, which is a part of the second program stored in the first partial area, to the second storage area, the portion of the data corresponding to the second partial program. The second subprogram may be updated to the first subprogram using the data.
　これにより、更新処理中において第１プログラムから第２プログラムへの更新が失敗した場合であっても、第１記憶領域に第１プログラムが格納されている状態に戻すことができる。 As a result, even if the update from the first program to the second program fails during the update process, it is possible to return to the state in which the first program is stored in the first storage area.
　また、前記更新制御部は、前記第１プログラムを更新している間に当該更新が失敗した場合、更新が失敗した第１部分領域が前記複数の第１部分領域のうちの特定の第１部分領域より処理順で前か後かを判定し、前記判定の結果、更新が失敗した前記第１部分領域が処理順で前記特定の第１部分領域より前である場合、更新済みの前記複数の第１部分領域と、更新が失敗した第１部分領域とのそれぞれについて、当該第１部分領域に格納されている第２プログラムの一部である第２部分プログラムを前記第２記憶領域にコピーした後で、前記データのうちで前記第２部分プログラムに対応する部分データを用いて前記第２部分プログラムを前記第１部分プログラムに更新し、前記判定の結果、更新が失敗した前記第１部分領域が処理順で前記特定の第１部分領域より後である場合、全ての前記複数の第１部分領域について、当該第１部分領域に格納されている前記第１部分プログラムを前記第２部分プログラムに更新し、前記第１プログラムを前記第２プログラムに更新した後で、前記第２プログラムが格納されている第３記憶領域が分割された複数の第２部分領域のそれぞれについて、当該第２部分領域に格納されている第２プログラムの一部である第３部分プログラムを前記第２記憶領域にコピーし、当該コピーの後で、前記データのうちで前記第３部分プログラムに対応する部分データを用いて前記第３部分プログラムを前記第１プログラムの一部である第４部分プログラムに更新してもよい。 Further, when the update fails while the update control unit is updating the first program, the first partial region in which the update fails is a specific first portion of the plurality of first partial regions. It is determined from the area whether it is before or after the processing order, and as a result of the determination, when the first partial area for which the update has failed is before the specific first partial area in the processing order, the plurality of updated items. For each of the first partial area and the first partial area for which the update failed, the second partial program, which is a part of the second program stored in the first partial area, was copied to the second storage area. Later, the second partial program is updated to the first partial program using the partial data corresponding to the second partial program in the data, and as a result of the determination, the update fails in the first partial region. Is later than the specific first partial region in the processing order, the first partial program stored in the first partial region is used as the second partial program for all the plurality of first partial regions. After updating and updating the first program to the second program, the second subregion is divided for each of the plurality of second subregions in which the third storage area in which the second program is stored is divided. The third partial program, which is a part of the second program stored in, is copied to the second storage area, and after the copy, the partial data corresponding to the third partial program is used in the data. The third partial program may be updated to the fourth partial program which is a part of the first program.
　これにより、更新処理中において第１プログラムから第２プログラムへの更新が失敗した場合であっても、失敗した第１部分領域の位置に応じて、処理を変更するため、処理に要する時間を低減することができる。 As a result, even if the update from the first program to the second program fails during the update process, the process is changed according to the position of the failed first partial area, so that the time required for the process is reduced. can do.
　なお、これらの全般的または具体的な態様は、システム、方法、集積回路、コンピュータプログラムまたはコンピュータ読み取り可能なＣＤ－ＲＯＭなどの記録媒体で実現されてもよく、システム、方法、集積回路、コンピュータプログラムおよび記録媒体の任意な組み合わせで実現されてもよい。 It should be noted that these general or specific embodiments may be realized in a recording medium such as a system, method, integrated circuit, computer program or computer readable CD-ROM, system, method, integrated circuit, computer program. And any combination of recording media may be realized.
　以下、適宜図面を参照しながら、実施の形態を詳細に説明する。但し、必要以上に詳細な説明は省略する場合がある。例えば、既によく知られた事項の詳細説明や実質的に同一の構成に対する重複説明を省略する場合がある。これは、以下の説明が不必要に冗長になるのを避け、当業者の理解を容易にするためである。 Hereinafter, embodiments will be described in detail with reference to the drawings as appropriate. However, more detailed explanation than necessary may be omitted. For example, detailed explanations of already well-known matters and duplicate explanations for substantially the same configuration may be omitted. This is to avoid unnecessary redundancy of the following description and to facilitate the understanding of those skilled in the art.
　なお、発明者（ら）は、当業者が本開示を十分に理解するために添付図面および以下の説明を提供するのであって、これらによって請求の範囲に記載の主題を限定することを意図するものではない。 It should be noted that the inventors (or others) intend to limit the subject matter described in the claims by those skilled in the art by providing the accompanying drawings and the following description in order to fully understand the present disclosure. It's not a thing.
　（実施の形態）
　以下、図１～図１３を用いて、実施の形態を説明する。 (Embodiment)
Hereinafter, embodiments will be described with reference to FIGS. 1 to 13.
　［構成］
　図１は、実施の形態に係る自動車への更新用のプログラムを配信するシステムの概略図である。 [Constitution]
FIG. 1 is a schematic diagram of a system for delivering a program for updating to an automobile according to an embodiment.
　具体的には、図１において、サーバ１００、自動車２００、通信ネットワーク３００および移動体通信網の基地局３１０が示されている。 Specifically, in FIG. 1, a server 100, an automobile 200, a communication network 300, and a base station 310 of a mobile communication network are shown.
　サーバ１００は、自動車２００が備えるＥＣＵ（Ｅｌｅｃｔｒｏｎｉｃ　Ｃｏｎｔｒｏｌ　Ｕｎｉｔ）などの電子機器のプログラム（ファームウェア）を記憶しており、自動車２００に当該プログラムを、通信ネットワーク３００を介して提供する装置である。 The server 100 is a device that stores a program (firmware) of an electronic device such as an ECU (Electronic Control Unit) included in the automobile 200, and provides the program to the automobile 200 via a communication network 300.
　自動車２００は、基地局３１０を介して移動体通信網に通信接続することが可能な移動体である。 The automobile 200 is a mobile body capable of communicating with the mobile communication network via the base station 310.
　このように、図１では、ＯＴＡ（Ｏｖｅｒ　Ｔｈｅ　Ａｉｒ）で、自動車２００のＥＣＵの更新用のプログラムが自動車２００に配信されることで、ＥＣＵのプログラムが更新される例が示されている。なお、ＥＣＵのプログラムの更新方法は、ＯＴＡを用いて更新することに限らない。例えば、更新用の装置を自動車２００に有線接続して、更新用の装置を用いて記録媒体に記録された更新用プログラムを、自動車２００のＥＣＵに適用する手法が用いられてもよい。つまり、自動車２００が備える各ＥＣＵは、更新用のプログラムをＯＴＡなどにより無線通信で取得してもよいし、更新用の装置などを介して有線通信で取得してもよい。 As described above, FIG. 1 shows an example in which the ECU program is updated by delivering the program for updating the ECU of the automobile 200 to the automobile 200 by OTA (Over The Air). The method of updating the ECU program is not limited to updating using OTA. For example, a method may be used in which the update device is connected to the automobile 200 by wire and the update program recorded on the recording medium using the update device is applied to the ECU of the automobile 200. That is, each ECU included in the automobile 200 may acquire the update program by wireless communication by OTA or the like, or may acquire the update program by wired communication via the update device or the like.
　図２は、実施の形態に係るサーバのハードウェア構成の一例を示すブロック図である。 FIG. 2 is a block diagram showing an example of the hardware configuration of the server according to the embodiment.
　図２に示すように、サーバ１００は、ハードウェア構成として、ＣＰＵ１１（Ｃｅｎｔｒａｌ　Ｐｒｏｃｅｓｓｉｎｇ　Ｕｎｉｔ）と、メインメモリ１２と、ストレージ１３と、通信ＩＦ（Ｉｎｔｅｒｆａｃｅ）１４とを備える。 As shown in FIG. 2, the server 100 includes a CPU 11 (Central Processing Unit), a main memory 12, a storage 13, and a communication IF (Interface) 14 as a hardware configuration.
　ＣＰＵ１１は、ストレージ１３等に記憶された制御プログラムを実行するプロセッサである。 The CPU 11 is a processor that executes a control program stored in the storage 13 or the like.
　メインメモリ１２は、ＣＰＵ１１が制御プログラムを実行するときに使用するワークエリアとして用いられる揮発性の記憶領域である。 The main memory 12 is a volatile storage area used as a work area used by the CPU 11 when executing a control program.
　ストレージ１３は、制御プログラム、コンテンツなどを保持する不揮発性の記憶領域である。 The storage 13 is a non-volatile storage area for holding control programs, contents, and the like.
　通信ＩＦ１４は、通信ネットワーク３００を介して複数の自動車２００と通信する通信インタフェースである。通信ＩＦ１４は、例えば、有線ＬＡＮインタフェースである。なお、通信ＩＦ１４は、無線ＬＡＮインタフェースであってもよい。また、通信ＩＦ１４は、ＬＡＮインタフェースに限らずに、通信ネットワークとの通信接続を確立できる通信インタフェースであれば、どのような通信インタフェースであってもよい。 The communication IF 14 is a communication interface that communicates with a plurality of automobiles 200 via the communication network 300. The communication IF 14 is, for example, a wired LAN interface. The communication IF 14 may be a wireless LAN interface. Further, the communication IF 14 is not limited to the LAN interface, and may be any communication interface as long as it can establish a communication connection with the communication network.
　図３は、実施の形態に係る自動車が備える情報処理装置２１０のハードウェア構成の一例を示すブロック図である。 FIG. 3 is a block diagram showing an example of the hardware configuration of the information processing device 210 included in the automobile according to the embodiment.
　図３に示すように、情報処理装置２１０は、ハードウェア構成として、ＴＣＵ（Ｔｅｌｅｍａｔｉｃｓ　Ｃｏｎｔｒｏｌ　Ｕｎｉｔ）２１と、ｎ個のＥＣＵ２２とを備える。なお、情報処理装置２１０は、図３に示されるハードウェア構成を全て含んでいなくてもよい。例えば、情報処理装置２１０は、ＴＣＵ２１を有していなくてもよい。 As shown in FIG. 3, the information processing device 210 includes a TCU (Telematics Control Unit) 21 and n ECUs 22 as a hardware configuration. The information processing device 210 does not have to include all the hardware configurations shown in FIG. For example, the information processing device 210 does not have to have the TCU 21.
　ＴＣＵ２１は、自動車２００が通信ネットワーク３００との間で無線通信を行う通信ユニットである。ＴＣＵ２１は、移動体通信網の規格に対応したセルラモジュールを含む通信ユニットである。 The TCU 21 is a communication unit in which the automobile 200 performs wireless communication with the communication network 300. The TCU 21 is a communication unit including a cellular module corresponding to the standard of the mobile communication network.
　ｎ個のＥＣＵ２２は、自動車２００が備えるエンジン、モータ、メータ、トランスミッション、ブレーキ、ステアリング、パワーウィンドウ、エアコンなどの各種機器の制御を実行する制御回路である。例えば、ｎ個のＥＣＵ２２は、これらの各種機器のそれぞれに対応して設けられている。ｎ個のＥＣＵ２２のそれぞれは、ここでは図示しないが、各ＥＣＵ２２が実行するプログラムを格納している記憶部（不揮発性の記憶領域）を備えていてもよい。記憶部は、例えば、不揮発性のメモリである。 The n ECUs 22 are control circuits that execute control of various devices such as an engine, a motor, a meter, a transmission, a brake, a steering wheel, a power window, and an air conditioner included in the automobile 200. For example, n ECUs 22 are provided corresponding to each of these various devices. Although not shown here, each of the n ECUs 22 may include a storage unit (nonvolatile storage area) for storing a program executed by each ECU 22. The storage unit is, for example, a non-volatile memory.
　ストレージ２３は、制御プログラムなどを保持する不揮発性の記憶領域である。ストレージ２３は、例えば、ＨＤＤ（Ｈａｒｄ　Ｄｉｓｋ　Ｄｒｉｖｅ）、ＳＳＤ（Ｓｏｌｉｄ　Ｓｔａｔｅｄ　Ｄｒｉｖｅ）などにより実現される。 The storage 23 is a non-volatile storage area for holding a control program or the like. The storage 23 is realized by, for example, an HDD (Hard Disk Drive), an SSD (Solid Stated Drive), or the like.
　次に、自動車２００の情報処理装置２１０の機能構成について図４を用いて説明する。 Next, the functional configuration of the information processing device 210 of the automobile 200 will be described with reference to FIG.
　図４は、実施の形態に係る情報処理装置２１０の機能構成の一例を示すブロック図である。 FIG. 4 is a block diagram showing an example of the functional configuration of the information processing device 210 according to the embodiment.
　情報処理装置２１０は、管理ＥＣＵ２２０と、ＥＣＵ２３０と、記憶部２４０とを備える。 The information processing device 210 includes a management ECU 220, an ECU 230, and a storage unit 240.
　管理ＥＣＵ２２０は、ＥＣＵ２３０が実行するプログラムの更新を管理するＥＣＵである。管理ＥＣＵ２２０は、ＥＣＵ２３０に仮想ストレージとして機能する記憶部２４０を提供する。管理ＥＣＵ２２０は、例えば、ｎ個のＥＣＵ２２のうちの少なくとも１つのＥＣＵにより実現される。管理ＥＣＵ２２０は、ＴＣＵ２１を含んでいてもよい。管理ＥＣＵ２２０は、第２制御器の一例である。 The management ECU 220 is an ECU that manages updates of programs executed by the ECU 230. The management ECU 220 provides the ECU 230 with a storage unit 240 that functions as virtual storage. The management ECU 220 is realized by, for example, at least one of n ECUs 22. The management ECU 220 may include the TCU 21. The management ECU 220 is an example of the second controller.
　記憶部２４０は、管理ＥＣＵ２２０を介して仮想ストレージとしてＥＣＵ２３０に提供される。記憶部２４０は、第１記憶領域２４１、第２記憶領域２４２および第３記憶領域２４３を有する。第１記憶領域２４１には、ＥＣＵ２３０が起動時に実行する第１プログラムが格納されている。第１プログラムは、ＥＣＵ２３０が現在使用中のプログラムである。なお、ＥＣＵ２３０が現在使用中のプログラムとは、ＥＣＵ２３０が起動する際に、使用することが定められているプログラムであり、必ずしもＥＣＵ２３０が実行中のプログラムを指すものではない。 The storage unit 240 is provided to the ECU 230 as virtual storage via the management ECU 220. The storage unit 240 has a first storage area 241, a second storage area 242, and a third storage area 243. The first storage area 241 stores a first program executed by the ECU 230 at startup. The first program is the program currently in use by the ECU 230. The program currently in use by the ECU 230 is a program that is defined to be used when the ECU 230 is started, and does not necessarily mean a program that is being executed by the ECU 230.
　第２記憶領域２４２は、第１記憶領域２４１とは異なる記憶領域であって、第１記憶領域２４１の記憶容量よりも小さい記憶容量を有する記憶領域である。第２記憶領域２４２は、第１プログラムの更新の際に用いられ、第１プログラムの一部である第１部分プログラムが一時的に格納される記憶領域である。 The second storage area 242 is a storage area different from the first storage area 241 and has a storage capacity smaller than the storage capacity of the first storage area 241. The second storage area 242 is a storage area that is used when updating the first program and temporarily stores the first partial program that is a part of the first program.
　第３記憶領域２４３は、第１プログラムの更新に用いられる更新用データが一時的に格納される記憶領域である。第３記憶領域２４３は、第１記憶領域２４１および第２記憶領域２４２とは異なる記憶領域であって、第１記憶領域２４１の記憶容量よりも小さい記憶容量を有する記憶領域である。また、第２記憶領域２４２の記憶容量および第３記憶領域２４３の記憶容量を加算した記憶容量は、第１記憶領域２４１の記憶容量よりも小さい。 The third storage area 243 is a storage area in which update data used for updating the first program is temporarily stored. The third storage area 243 is a storage area different from the first storage area 241 and the second storage area 242, and has a storage capacity smaller than the storage capacity of the first storage area 241. Further, the storage capacity obtained by adding the storage capacity of the second storage area 242 and the storage capacity of the third storage area 243 is smaller than the storage capacity of the first storage area 241.
　記憶部２４０は、ストレージ２３により実現される。 The storage unit 240 is realized by the storage 23.
　ＥＣＵ２３０は、記憶部２４０の第１プログラムが格納されている第１記憶領域にアクセスし、第１プログラムを実行する。ＥＣＵ２３０は、起動時に第１プログラムを実行することで自身の機能を実現する。ＥＣＵ２３０は、例えば、ｎ個のＥＣＵ２２のうちの管理ＥＣＵ２２０を実現するＥＣＵ２２とは異なる少なくとも１つのＥＣＵにより実現される。ＥＣＵ２３０は、第１制御器の一例である。 The ECU 230 accesses the first storage area in which the first program of the storage unit 240 is stored, and executes the first program. The ECU 230 realizes its own function by executing the first program at the time of startup. The ECU 230 is realized by, for example, at least one ECU different from the ECU 22 that realizes the management ECU 220 among the n ECUs 22. The ECU 230 is an example of the first controller.
　以下、管理ＥＣＵ２２０およびＥＣＵ２３０の具体的な機能について説明する。 Hereinafter, specific functions of the management ECU 220 and the ECU 230 will be described.
　管理ＥＣＵ２２０は、具体的には、更新制御部２２１と、提供部２２２とを有する。 Specifically, the management ECU 220 has an update control unit 221 and a provision unit 222.
　更新制御部２２１は、ＥＣＵ２３０が実行する第１プログラムを、新たな第２プログラムに更新する更新処理を制御する。更新制御部２２１は、具体的には、外部装置から第１プログラムの更新用のデータである更新用データを取得し、取得した更新用データを用いて第１プログラムを新たな第２プログラムに更新する。更新制御部２２１は、取得した更新用データを第３記憶領域２４３に格納する。更新制御部２２１による更新処理の制御の詳細は、後述する。なお、外部装置は、例えば、サーバ１００、または、更新用の装置である。 The update control unit 221 controls an update process for updating the first program executed by the ECU 230 to a new second program. Specifically, the update control unit 221 acquires update data, which is data for updating the first program, from an external device, and updates the first program to a new second program using the acquired update data. do. The update control unit 221 stores the acquired update data in the third storage area 243. Details of control of the update process by the update control unit 221 will be described later. The external device is, for example, a server 100 or a device for updating.
　提供部２２２は、記憶部２４０を実現しているストレージ２３を用いて、ＥＣＵ２３０に対して仮想ストレージ２６０を提供する処理部である。提供部２２２は、仮想クライアント機能を有するＥＣＵ２３０からアクセスされ、ストレージ２３の実記憶領域に格納されている第１プログラムが格納されている仮想ストレージをＥＣＵ２３０に提供する。また、提供部２２２は、更新制御部２２１により第１プログラムから第２プログラムへの更新処理が実行中である場合には、ストレージ２３の実記憶領域に格納されている第１プログラムの一部、および、更新用データを用いて第２プログラムが格納されている仮想ストレージをＥＣＵ２３０に提供する。提供部２２２による提供処理の詳細は、後述する。 The providing unit 222 is a processing unit that provides the virtual storage 260 to the ECU 230 by using the storage 23 that realizes the storage unit 240. The providing unit 222 provides the ECU 230 with virtual storage in which the first program stored in the real storage area of the storage 23 is stored, which is accessed from the ECU 230 having the virtual client function. Further, when the update control unit 221 is executing the update process from the first program to the second program, the providing unit 222 is a part of the first program stored in the real storage area of the storage 23. Then, the ECU 230 is provided with virtual storage in which the second program is stored using the update data. Details of the provision process by the provision unit 222 will be described later.
　ＥＣＵ２３０は、具体的には、制御部２３１と、クライアント部２３２とを有する。 Specifically, the ECU 230 has a control unit 231 and a client unit 232.
　制御部２３１は、管理ＥＣＵ２２０によって提供された仮想ストレージに格納されている第１プログラムまたは第２プログラムを実行して、ＥＣＵ２３０の機能を実現する処理部である。制御部２３１は、具体的には、クライアント部２３２を制御して、管理ＥＣＵ２２０により提供された仮想ストレージにアクセスし、仮想ストレージに格納されている第１プログラムまたは第２プログラムを実行する。 The control unit 231 is a processing unit that executes the first program or the second program stored in the virtual storage provided by the management ECU 220 to realize the function of the ECU 230. Specifically, the control unit 231 controls the client unit 232 to access the virtual storage provided by the management ECU 220 and execute the first program or the second program stored in the virtual storage.
　クライアント部２３２は、管理ＥＣＵ２２０の提供部２２２との間で情報をやり取りすることで、提供部２２２から仮想ストレージとして機能する記憶部２４０に格納されている第１プログラムまたは第２プログラムの提供を受ける処理部である。 The client unit 232 receives the provision of the first program or the second program stored in the storage unit 240 that functions as virtual storage from the providing unit 222 by exchanging information with the providing unit 222 of the management ECU 220. It is a processing unit.
　次に、更新処理の制御、および、提供処理の詳細について図５を用いて説明する。図５は、更新処理の制御、および、提供処理について説明するための図である。なお、図５は、更新処理の途中の時点を示す図である。 Next, the control of the update process and the details of the provided process will be described with reference to FIG. FIG. 5 is a diagram for explaining control of update processing and provision processing. Note that FIG. 5 is a diagram showing a time point during the update process.
　まず、更新制御部２２１による更新処理の制御について説明する。 First, the control of the update process by the update control unit 221 will be described.
　更新制御部２２１は、第１プログラムが格納されている第１記憶領域２４１が複数に分割された複数の第１部分領域２５１～２５５のそれぞれについて、取得した更新用データを用いて、当該第１部分領域に格納されている第１部分プログラムを新たな第２プログラムの一部である第２部分プログラムに更新する。具体的には、更新制御部２２１は、複数の第１部分領域２５１～２５５のうちの処理対象の第１部分領域を１つずつ予め定められた順番に選択する。そして、更新制御部２２１は、選択した処理対象の第１部分領域に格納されている第１部分プログラムを第２記憶領域２４２にコピーする。その後、更新制御部２２１は、処理対象の第１部分領域に格納されている第１部分プログラムに更新用データを適用して第２部分プログラムを生成し、処理対象の第１部分領域の第１部分プログラムを、生成した第２部分プログラムで書き換えることで第１部分プログラムを第２部分プログラムに更新する。なお、予め定められた順番は、例えば、ストレージ２３におけるアクセス順であってもよい。 The update control unit 221 uses the acquired update data for each of the plurality of first partial areas 251 to 255 in which the first storage area 241 in which the first program is stored is divided into a plurality of the first storage areas 241. The first partial program stored in the partial area is updated to the second partial program which is a part of the new second program. Specifically, the update control unit 221 selects the first subregions to be processed one by one from the plurality of first subregions 251 to 255 in a predetermined order. Then, the update control unit 221 copies the first partial program stored in the first partial area of the selected processing target to the second storage area 242. After that, the update control unit 221 applies the update data to the first partial program stored in the first partial area of the processing target to generate the second partial program, and the first of the first partial area of the processing target. The first subprogram is updated to the second subprogram by rewriting the subprogram with the generated second subprogram. The predetermined order may be, for example, the access order in the storage 23.
　なお、複数の第１部分領域２５１～２５５は、ストレージ２３の実記憶領域において連続して配置されている記憶領域であってもよいし、各第１部分領域が隣り合う第１部分領域との間で所定の記憶領域の間隔を空けて配置されている記憶領域であってもよい。所定の記憶領域の間隔を空けて配置されている場合、隣り合う第１部分領域との間の所定の記憶領域には、空き領域または空き領域を示すデータが格納されていてもよい。所定の記憶領域は、更新後の第２部分プログラムが第１部分領域２５１の記憶容量を超えるデータ量である場合に、第１部分領域２５１に格納しきれなかった第２部分プログラムが格納されてもよい。この場合に利用される所定の記憶領域は、第１部分領域２５１に隣接して配置される記憶領域であってもよい。なお、上記は、ストレージ２３がシーケンシャルにアクセスされる記録媒体が用いられるＨＤＤなどで実現される場合に適用されうる。ストレージ２３がランダムアクセスされるＳＤＤなどの不揮発性メモリで実現される場合には、この限りではない。 The plurality of first partial areas 251 to 255 may be storage areas that are continuously arranged in the real storage area of the storage 23, or the first partial areas may be adjacent to the first partial area. The storage areas may be arranged at intervals of predetermined storage areas. When the predetermined storage areas are arranged at intervals, the free area or data indicating the free area may be stored in the predetermined storage area between the predetermined storage areas and the adjacent first partial areas. The predetermined storage area stores the second partial program that could not be stored in the first partial area 251 when the updated second partial program has an amount of data exceeding the storage capacity of the first partial area 251. May be good. The predetermined storage area used in this case may be a storage area arranged adjacent to the first partial area 251. The above can be applied when the storage 23 is realized by an HDD or the like in which a recording medium that is sequentially accessed is used. This is not the case when the storage 23 is realized by a non-volatile memory such as an SDD that is randomly accessed.
　また、複数の第１部分領域は、５つの領域を含む例を示したが、５つの領域を含むことに限らずに、５以外の複数の領域を含んでもよい。 Further, although the example in which the plurality of first subregions include five regions is shown, the region may include a plurality of regions other than five, not limited to the inclusion of five regions.
　第１部分プログラムは、第１プログラムのうちの複数の第１部分領域２５１～２５５のそれぞれに格納されている部分的なプログラムである。第１部分プログラムは、第１プログラムを構成するコードのうち対応する第１部分領域に格納されているコードである。第１プログラムは、第１記憶領域２４１を構成する複数の第１部分領域２５１～２５５に亘って（またがって）格納されている。第１プログラムは、第１のプログラムを構成する全ての複数の第１部分プログラムがないと機能しない。 The first partial program is a partial program stored in each of a plurality of first partial areas 251 to 255 of the first program. The first partial program is code stored in the corresponding first partial area among the codes constituting the first program. The first program is stored (across) over a plurality of first subregions 251 to 255 constituting the first storage area 241. The first program does not function without all the plurality of first partial programs constituting the first program.
　第２部分プログラムは、第２プログラムの一部であり、複数の第１部分プログラムのそれぞれに更新用データが適用されることで生成される部分的なプログラムである。第２部分プログラムは、第２プログラムを構成するコードのうち、当該第２部分プログラムに対応する第１部分プログラムが更新用データを用いて更新されることで生成されるコードである。更新制御部２２１による更新が完了すると、複数の第１部分領域２５１～２５５に格納されている全ての複数の第１部分プログラムは、複数の第２部分プログラムに書き換えられる。このため、複数の第１部分領域２５１～２５５には、複数の第２部分プログラムが格納される。第２プログラムは、第２のプログラムを構成する全ての複数の第２部分プログラムがないと機能しない。 The second part program is a part of the second program, and is a partial program generated by applying update data to each of a plurality of first part programs. The second subprogram is a code generated by updating the first subprogram corresponding to the second subprogram among the codes constituting the second program using the update data. When the update by the update control unit 221 is completed, all the plurality of first subprograms stored in the plurality of first subregions 251 to 255 are rewritten into the plurality of second subprograms. Therefore, a plurality of second partial programs are stored in the plurality of first partial regions 251 to 255. The second program does not work without all the plurality of second subprograms that make up the second program.
　次に、更新処理の詳細について図６を用いて説明する。図６は、実施の形態に係る更新処理の詳細の一例について説明するための図である。図６の（ａ）は、第１部分プログラムを構成する複数の第１データ単位Ｄ１～Ｄ４と各第１データ単位の第１部分プログラムを構成するデータ上におけるアドレス（位置）との関係を示す図である。図６の（ｂ）は、第２部分プログラムを構成する複数の第２データ単位Ｄ１、Ｄ２、Ｄ５、Ｄ６と各第２データ単位の第２部分プログラムを構成するデータ上におけるアドレス（位置）との関係を示す図である。 Next, the details of the update process will be described with reference to FIG. FIG. 6 is a diagram for explaining a detailed example of the update process according to the embodiment. FIG. 6A shows the relationship between the plurality of first data units D1 to D4 constituting the first partial program and the addresses (positions) on the data constituting the first partial program of each first data unit. It is a figure. FIG. 6B shows the plurality of second data units D1, D2, D5, and D6 constituting the second subprogram and the addresses (positions) on the data constituting the second subprogram of each second data unit. It is a figure which shows the relationship of.
　ここで、プログラム上におけるアドレスとは、例えば、所定の基準アドレス（例えば当該プログラムの先頭のアドレス、絶対値）からの相対値（オフセット値）で示されてもよい。例えば、第１データ単位Ｄ２の第１部分プログラム上におけるアドレスｘ１は、基準アドレスｘ０と、第１データ単位Ｄ２より前に格納されている第１データ単位Ｄ１のデータ長Ｌ１とにより算出されてもよい。つまり、アドレスｘ１は、基準アドレスｘ０にデータ長Ｌ１を加算することにより算出されてもよい。 Here, the address on the program may be indicated by, for example, a relative value (offset value) from a predetermined reference address (for example, the start address of the program, an absolute value). For example, the address x1 on the first partial program of the first data unit D2 may be calculated by the reference address x0 and the data length L1 of the first data unit D1 stored before the first data unit D2. good. That is, the address x1 may be calculated by adding the data length L1 to the reference address x0.
　図６の（ｃ）は、更新用データの構成を示す図である。更新用データは、複数の差分データと、対応関係情報とを含む。更新用データは、さらに、複数の差分データ、および、その対応関係情報を特定するための番号（シーケンス番号）を含んでいてもよい。複数の差分データは、第１部分プログラムを構成する複数の第１データ単位Ｄ１～Ｄ４、および、第２部分プログラムを構成する複数の第２データ単位Ｄ１、Ｄ２、Ｄ５、Ｄ６との間の差分を示すデータである。対応関係情報は、複数の差分データのそれぞれに対応する第１データ単位の第１部分プログラム上におけるアドレス、および、複数の差分データのそれぞれに対応する第２データ単位の第２部分プログラム上におけるアドレスを含む。つまり、対応関係情報は、各差分データに対応する第１データ単位および第２データ単位を特定するための情報である。 FIG. 6C is a diagram showing the structure of update data. The update data includes a plurality of difference data and correspondence information. The update data may further include a plurality of difference data and a number (sequence number) for specifying the correspondence information thereof. The plurality of difference data is the difference between the plurality of first data units D1 to D4 constituting the first partial program and the plurality of second data units D1, D2, D5, D6 constituting the second partial program. It is the data which shows. The correspondence information includes an address on the first partial program of the first data unit corresponding to each of the plurality of difference data, and an address on the second partial program of the second data unit corresponding to each of the plurality of difference data. including. That is, the correspondence information is information for specifying the first data unit and the second data unit corresponding to each difference data.
　図６の（ｃ）では、対応関係情報において、対応関係にある第１部分プログラムの第１データ単位と第２部分プログラムの第２データ単位とが示されている。 In FIG. 6C, the correspondence relationship information shows the first data unit of the first subprogram and the second data unit of the second subprogram that are in a correspondence relationship.
　番号０１の対応関係情報では、第１部分プログラムのデータ上のアドレスｘ０に配置される第１データ単位Ｄ１と、第２部分プログラムのデータ上のアドレスｘ０に配置される第２データ単位Ｄ１とが対応関係にあることが示されている。そして、番号０１の差分データは、０であるため、第１データ単位Ｄ１と第２データ単位Ｄ１とは同じデータ単位であることが示されている。つまり、更新制御部２２１は、第１部分プログラムのデータ上のアドレスｘ０に配置される第１データ単位Ｄ１に差分データとして０を加算することで、第２データ単位Ｄ１を生成することができる。 In the correspondence information of the number 01, the first data unit D1 arranged at the address x0 on the data of the first subprogram and the second data unit D1 arranged at the address x0 on the data of the second subprogram It is shown that there is a correspondence. Since the difference data of the number 01 is 0, it is shown that the first data unit D1 and the second data unit D1 are the same data unit. That is, the update control unit 221 can generate the second data unit D1 by adding 0 as the difference data to the first data unit D1 arranged at the address x0 on the data of the first subprogram.
　番号０２の対応関係情報では、第１部分プログラムに対応するアドレスがなく、かつ、第２部分プログラムに対応するアドレスがｘ１であることが示されている。これにより、第２部分プログラムでは、アドレスｘ１において差分データで示される第２データ単位Ｄ５が、前の番号０１の第２データ単位Ｄ１の後に挿入されていることが示されている。つまり、更新制御部２２１は、前回生成した第２データ単位Ｄ１のアドレスｘ０に、前回生成した第２データ単位Ｄ１のデータ長Ｌ１を加算することでアドレスｘ１を特定し、特定したアドレスｘ１に、番号０２における差分データで示されるデータ単位Ｄ５を挿入する。これにより、更新制御部２２１は、第２部分プログラムのデータ上のアドレスｘ１に第２データ単位Ｄ５を生成することができる。 The correspondence information of the number 02 indicates that there is no address corresponding to the first subprogram and the address corresponding to the second subprogram is x1. Thereby, in the second subprogram, it is shown that the second data unit D5 represented by the difference data at the address x1 is inserted after the second data unit D1 of the previous number 01. That is, the update control unit 221 identifies the address x1 by adding the data length L1 of the second data unit D1 generated last time to the address x0 of the second data unit D1 generated last time, and assigns the address x1 to the specified address x1. The data unit D5 indicated by the difference data in the number 02 is inserted. As a result, the update control unit 221 can generate the second data unit D5 at the address x1 on the data of the second subprogram.
　また、番号０４の対応関係情報では、第１部分プログラムのデータ上のアドレスｘ３に配置される第１データ単位Ｄ４と、第２部分プログラムのデータ上のアドレスｘ６に配置される第２データ単位Ｄ６とが対応関係にあることが示されている。そして、番号０４の差分データは、０ではないＤ６－Ｄ４であるため、第１データ単位Ｄ４と第２データ単位Ｄ６とは異なるデータ単位であることが示されている。つまり、更新制御部２２１は、前回生成した第２データ単位Ｄ２のアドレスｘ５に、前回生成した第２データ単位Ｄ２のデータ長Ｌ２を加算することでアドレスｘ６を特定する。更新制御部２２１は、番号０４における差分データであるＤ６－Ｄ４を第１データ単位Ｄ４に加算することで、第２データ単位Ｄ６を生成し、生成した第２データ単位Ｄ６を特定したアドレスｘ６に配置する。 Further, in the correspondence information of the number 04, the first data unit D4 arranged at the address x3 on the data of the first subprogram and the second data unit D6 arranged at the address x6 on the data of the second subprogram. It is shown that there is a correspondence between and. Since the difference data of the number 04 is D6-D4 which is not 0, it is shown that the first data unit D4 and the second data unit D6 are different data units. That is, the update control unit 221 specifies the address x6 by adding the data length L2 of the second data unit D2 generated last time to the address x5 of the second data unit D2 generated last time. The update control unit 221 generates the second data unit D6 by adding the difference data D6-D4 in the number 04 to the first data unit D4, and the generated second data unit D6 is assigned to the specified address x6. Deploy.
　また、番号０４の対応関係情報では、第１部分プログラムのデータ上のアドレスｘ３が示されており、第１部分プログラムの第１データ単位Ｄ１～Ｄ４のアドレスｘ０～ｘ３の並び順で、アドレスｘ３の１つ前のアドレスｘ２がスキップされている。これは、アドレスｘ３の第１データ単位Ｄ３を削除することを示している。よって、更新制御部２２１は、第１部分プログラムの第１データ単位Ｄ３を削除する。なお、更新制御部２２１は、削除した第１データ単位Ｄ３を第３記憶領域２４３に格納してもよい。 Further, in the correspondence information of the number 04, the address x3 on the data of the first subprogram is shown, and the address x3 is arranged in the order of the addresses x0 to x3 of the first data units D1 to D4 of the first subprogram. The address x2 immediately before is skipped. This indicates that the first data unit D3 at the address x3 is deleted. Therefore, the update control unit 221 deletes the first data unit D3 of the first subprogram. The update control unit 221 may store the deleted first data unit D3 in the third storage area 243.
　なお、番号０３を用いた処理の説明は省略する。 The description of the process using the number 03 will be omitted.
　このようにして、更新制御部２２１は、第１部分プログラムに更新用データを適用することで、第２部分プログラムを生成し、第１部分領域に格納されている第１部分プログラムを、生成した第２部分プログラムで置き換えることで、第１部分プログラムを第２部分プログラムに更新する。 In this way, the update control unit 221 generated the second partial program by applying the update data to the first partial program, and generated the first partial program stored in the first partial area. By replacing with the second part program, the first part program is updated to the second part program.
　差分データは、第１部分プログラムおよび第２部分プログラムが互いに類似している可能性が高いため、差分データのデータ量は、小さくなる。このため、更新用データのデータ量を第２部分プログラムよりも小さくすることができる。 As for the difference data, since the first part program and the second part program are likely to be similar to each other, the amount of difference data is small. Therefore, the amount of update data can be made smaller than that of the second subprogram.
　なお、第１部分プログラムと第２部分プログラムとの間の差分は、バイナリ差分アルゴリズムを利用して求めることができる。この場合、対応関係情報は、図６の（ｃ）に示される情報に限らずに、差分データの処理内容（加算、挿入、削除）と当該処理内容における処理対象のデータ長とを示すデータにより算出されてもよい。これにより、図６の（ｃ）に示される第１データ単位のアドレスと第２データ単位のアドレスとを特定することができる。 The difference between the first part program and the second part program can be obtained by using the binary difference algorithm. In this case, the correspondence information is not limited to the information shown in FIG. 6C, but is based on data indicating the processing content (addition, insertion, deletion) of the difference data and the data length of the processing target in the processing content. It may be calculated. Thereby, the address of the first data unit and the address of the second data unit shown in FIG. 6C can be specified.
　なお、図６では、第１部分プログラムおよび第２部分プログラムを用いて説明したが、第１部分プログラムを第１プログラムに読み替え、第２部分プログラムを第２プログラムに読み替えることで、第１プログラムおよび第２プログラムについても同様に説明することができる。 Although the first and second subprograms have been described in FIG. 6, the first program and the first program and the second program can be read by replacing the first subprogram with the first program and the second subprogram with the second program. The second program can be described in the same manner.
　次に、図５を用いて、提供部２２２による提供処理について説明する。 Next, the provision process by the provision unit 222 will be described with reference to FIG.
　提供部２２２は、更新制御部２２１が第１プログラムを更新している間において、ＥＣＵ２３０から仮想ストレージ２６０へのアクセスを受け付けた場合、アクセス先の第１部分領域２５１～２５５の更新状態に応じて、下記に示す３つの処理のいずれかの処理を行うことで、ＥＣＵ２３０へ新たな第２プログラムを提供する。つまり、更新制御部２２１は、３つの更新状態（更新処理後、更新処理中、更新処理前）に応じて、異なる処理を行う。 When the update control unit 221 receives access to the virtual storage 260 from the ECU 230 while the update control unit 221 is updating the first program, the providing unit 222 responds to the update status of the first partial areas 251 to 255 of the access destination. , A new second program is provided to the ECU 230 by performing any of the three processes shown below. That is, the update control unit 221 performs different processes according to the three update states (after the update process, during the update process, and before the update process).
　（１）提供部２２２は、アクセス先が更新処理後（更新完了後）の第１部分領域２５１であれば、当該第１部分領域２５１に格納されている第２部分プログラムをＥＣＵ２３０に提供する。提供部２２２は、この場合、アクセスされた第１部分領域２５１に格納されているプログラムを既に第２部分プログラムに更新したため、第１部分領域２５１に格納されている更新後の第２部分プログラムをＥＣＵ２３０に提供する。 (1) If the access destination is the first partial area 251 after the update process (after the update is completed), the providing unit 222 provides the ECU 230 with the second partial program stored in the first partial area 251. In this case, the providing unit 222 has already updated the program stored in the accessed first partial area 251 to the second partial program, so that the updated second partial program stored in the first partial area 251 is used. Provided to ECU 230.
　（２）提供部２２２は、アクセス先が更新処理中の第１部分領域２５２であれば、第２記憶領域２４２に格納されている第１部分プログラムと、更新用データのうちで当該第１部分プログラムに対応する部分データとを用いて、当該第１部分プログラムを更新した第２部分プログラムを生成し、生成した第２部分プログラムをＥＣＵ２３０に提供する。提供部２２２は、この場合、アクセスされた第１部分領域２５１に格納されているプログラムが更新処理中であるため、更新処理中に第２記憶領域２４２に退避されている第１部分プログラムに、第３記憶領域２４３に格納されている更新用データのうちの当該第１部分プログラムに対応する部分データを適用して第２部分プログラムを生成する。つまり、この場合、提供部２２２は、アクセスされる度に第２部分プログラムを生成し、生成した第２部分プログラムをＥＣＵ２３０に提供する。 (2) If the access destination is the first partial area 252 during the update process, the providing unit 222 includes the first partial program stored in the second storage area 242 and the first portion of the update data. A second partial program in which the first partial program is updated is generated using the partial data corresponding to the program, and the generated second partial program is provided to the ECU 230. In this case, since the program stored in the accessed first partial area 251 is being updated, the providing unit 222 sends the first partial program saved in the second storage area 242 during the update process. The second partial program is generated by applying the partial data corresponding to the first partial program among the update data stored in the third storage area 243. That is, in this case, the providing unit 222 generates a second partial program each time it is accessed, and provides the generated second partial program to the ECU 230.
　（３）提供部２２２は、アクセス先が更新処理前の第１部分領域２５３～２５５のいずれかであれば、当該第１部分領域に格納されている第１部分プログラムと、更新用データのうちで当該第１部分プログラムに対応する部分データとを用いて、当該第１部分プログラムを更新した第２部分プログラムを生成し、生成した第２部分プログラムをＥＣＵ２３０に提供する。提供部２２２は、この場合、アクセスされた第１部分領域２５１に格納されているプログラムが更新処理前であるため、当該第１部分領域に格納されている第１部分プログラムに、第３記憶領域２４３に格納されている更新用データのうちの当該第１部分プログラムに対応する部分データを適用して第２部分プログラムを生成する。つまり、この場合、提供部２２２は、アクセスされる度に第２部分プログラムを生成し、生成した第２部分プログラムをＥＣＵ２３０に提供する。 (3) If the access destination is any of the first partial areas 253 to 255 before the update process, the providing unit 222 includes the first partial program stored in the first partial area and the update data. A second partial program in which the first partial program is updated is generated by using the partial data corresponding to the first partial program, and the generated second partial program is provided to the ECU 230. In this case, since the program stored in the accessed first partial area 251 is before the update process, the providing unit 222 stores the third storage area in the first partial program stored in the first partial area. Of the update data stored in 243, the partial data corresponding to the first partial program is applied to generate the second partial program. That is, in this case, the providing unit 222 generates a second partial program each time it is accessed, and provides the generated second partial program to the ECU 230.
　このように、提供部２２２は、アクセス先の第１部分領域の更新状態に応じた処理を行う。このため、提供部２２２は、第１プログラムを第２プログラムに更新している処理を行っている間であっても、更新された第２プログラムをＥＣＵ２３０に提供することができる。 In this way, the providing unit 222 performs processing according to the update state of the first partial area of the access destination. Therefore, the providing unit 222 can provide the updated second program to the ECU 230 even while the process of updating the first program to the second program is being performed.
　なお、提供部２２２は、上記の（２）および（３）の処理において、アクセスされる度に第２部分プログラムを生成するとしたが、これに限らない。例えば、提供部２２２は、初めてアクセスされたときに第２部分プログラムを生成して、生成した第２部分プログラムを記憶部２４０に一時的に保持しておき、２回目以降のアクセスがあった場合に、一時的に保持した第２部分プログラムをＥＣＵ２３０に提供してもよい。この場合、提供部２２２は、第２部分プログラムの生成を一度行うことで済むため、処理負荷を低減することができる。 Note that, in the processes (2) and (3) above, the providing unit 222 generates a second partial program each time it is accessed, but the present invention is not limited to this. For example, when the providing unit 222 generates a second partial program when it is accessed for the first time, temporarily holds the generated second partial program in the storage unit 240, and is accessed for the second time or later. In addition, the second partial program temporarily held may be provided to the ECU 230. In this case, since the providing unit 222 only needs to generate the second partial program once, the processing load can be reduced.
　なお、提供部２２２は、第２部分プログラムを記憶部２４０に一時的に保持するか否かについて、例えばＥＣＵ２３０によるアクセス頻度に応じて判断してもよい。この場合、提供部２２２は、ＥＣＵ２３０による各第１部分プログラムへのアクセス回数を記憶部２４０に一時的に保持しておき、アクセス回数が予め設定されたアクセス回数に達した場合には、生成した第２部分プログラムを記憶部２４０に一時的に保持し、ＥＣＵ２３０によるアクセス回数が予め設定されたアクセス回数に達していない場合には、生成した第２部分プログラムを記憶部２４０に一時的に保持しなくてもよい。 Note that the providing unit 222 may determine whether or not to temporarily hold the second part program in the storage unit 240 according to, for example, the access frequency by the ECU 230. In this case, the providing unit 222 temporarily holds the number of accesses to each first partial program by the ECU 230 in the storage unit 240, and generates when the number of accesses reaches a preset number of accesses. The second part program is temporarily held in the storage unit 240, and when the number of accesses by the ECU 230 does not reach the preset number of accesses, the generated second part program is temporarily held in the storage unit 240. It does not have to be.
　次に、更新制御部２２１による第１プログラムを第２プログラムに更新する更新処理中に更新処理が失敗した場合に行う、更新前の状態に戻す処理（ロールバック処理）の第１の例について図７を用いて説明する。図７は、更新処理が失敗した場合の処理の第１の例について説明するための図である。なお、更新制御部２２１は、複数の第１部分領域２５１～２５５のそれぞれの更新状態を記憶部２４０に記憶していてもよい。更新状態は、更新処理後（更新完了）、更新中、および、更新処理前（未処理）の３つの状態を含む。 Next, the figure shows the first example of the process (rollback process) of returning to the state before the update, which is performed when the update process fails during the update process of updating the first program to the second program by the update control unit 221. 7 will be described. FIG. 7 is a diagram for explaining a first example of processing when the update processing fails. The update control unit 221 may store the update states of the plurality of first subregions 251 to 255 in the storage unit 240. The update state includes three states: after the update process (update completed), during the update, and before the update process (unprocessed).
　図７の（ａ）に示すように、更新制御部２２１は、第１部分領域２５４における第１部分プログラムの更新に失敗した場合、図７の（ｂ）に示すように、全ての複数の第１部分領域２５１～２５５について、当該第１部分領域に格納されている第１部分プログラムを第２部分プログラムに更新する。つまり、更新制御部２２１は、更新に失敗した場合であっても、継続して未処理の第１部分領域に格納されている第１部分プログラムを第２部分プログラムに更新する。更新方法は、図５および図６を用いて説明した通りである。 As shown in FIG. 7 (a), when the update control unit 221 fails to update the first partial program in the first partial region 254, as shown in FIG. 7 (b), all the plurality of orders. For the 1 subregions 251 to 255, the first subprogram stored in the first subregion is updated to the second subprogram. That is, the update control unit 221 continuously updates the first partial program stored in the unprocessed first partial area to the second partial program even when the update fails. The update method is as described with reference to FIGS. 5 and 6.
　そして、更新制御部２２１は、第１プログラムを第２プログラムに更新した後で、第２プログラムが格納されている第１記憶領域２４１が分割された複数の第１部分領域２５１～２５５のそれぞれについて、第３記憶領域２４３に格納されている更新用データを用いて、当該第１部分領域に格納されている第２部分プログラムを元の第１プログラムの一部である第１部分プログラムに更新する。更新制御部２２１は、この処理を、第１プログラムを第２プログラムに更新する処理と同様に行う。つまり、更新制御部２２１による更新処理の制御において、第１プログラムを第２プログラムに、第２プログラムを第１プログラムに、第１部分プログラムを第２部分プログラムに、第２部分プログラムを第１部分プログラムにそれぞれ読み替えることで説明することができる。このときの、提供部２２２による提供処理についても同様である。 Then, the update control unit 221 updates each of the plurality of first partial areas 251 to 255 in which the first storage area 241 in which the second program is stored is divided after updating the first program to the second program. , The second partial program stored in the first partial area is updated to the first partial program which is a part of the original first partial program by using the update data stored in the third storage area 243. .. The update control unit 221 performs this process in the same manner as the process of updating the first program to the second program. That is, in the control of the update process by the update control unit 221, the first program is the second program, the second program is the first program, the first part program is the second part program, and the second part program is the first part. It can be explained by reading each program. The same applies to the provision process by the provision unit 222 at this time.
　なお、更新制御部２２１は、第２部分プログラムを元の第１部分プログラムに更新する場合、第３記憶領域２４３に格納されている更新用データを用いて更新するとしたが、これに限らない。例えば、更新制御部２２１は、第３記憶領域２４３に格納されている更新用データが、第２部分プログラムを元の第１部分プログラムに戻す更新処理に適用できないデータである場合、または、元に戻す更新処理に要する処理量が所定の処理量（例えば、第１部分プログラムから第２部分プログラムへの更新処理に要する処理量）よりも大きくなる場合、新たな更新用データを用いて元に戻す更新処理を行ってもよい。この場合、更新制御部２２１は、第２部分プログラムを元の第１部分プログラムに戻す更新処理のための新たな更新用データを外部装置から取得する。 Note that, when updating the second subprogram to the original first subprogram, the update control unit 221 is supposed to update using the update data stored in the third storage area 243, but the present invention is not limited to this. For example, when the update data stored in the third storage area 243 is data that cannot be applied to the update process of returning the second subprogram to the original first subprogram, the update control unit 221 may or may not be able to apply the update data to the original first subprogram. When the amount of processing required for the update process to be returned is larger than the predetermined amount of processing (for example, the amount of processing required for the update process from the first subprogram to the second subprogram), it is restored using new update data. The update process may be performed. In this case, the update control unit 221 acquires new update data for the update process of returning the second subprogram to the original first subprogram from the external device.
　次に、更新制御部２２１による第１プログラムを第２プログラムに更新する更新処理中に更新処理が失敗した場合に行う、更新前の状態に戻す処理（ロールバック処理）の第２の例について図８を用いて説明する。図８は、更新処理が失敗した場合の処理の第２の例について説明するための図である。 Next, the figure shows the second example of the process (rollback process) of returning to the state before the update, which is performed when the update process fails during the update process of updating the first program to the second program by the update control unit 221. This will be described with reference to 8. FIG. 8 is a diagram for explaining a second example of processing when the update processing fails.
　図８の（ａ）に示すように、更新制御部２２１は、第１部分領域２５２における第１部分プログラムの更新に失敗した場合、図８の（ｂ）に示すように、更新済みの１以上の第１部分領域２５１と、更新が失敗した第１部分領域２５２とのそれぞれについて、当該第１部分領域に格納されている第２部分プログラムを第２記憶領域２４２にコピーした後で、更新用データのうちで当該第２部分プログラムに対応する部分データを用いて第２部分プログラムを第１部分プログラムに更新する。更新制御部２２１は、この処理を、第１プログラムを第２プログラムに更新する処理と同様に行う。このときの、提供部２２２による提供処理についても同様である。 As shown in FIG. 8A, when the update control unit 221 fails to update the first partial program in the first partial region 252, the update control unit 221 has updated one or more as shown in FIG. 8B. For each of the first partial area 251 and the first partial area 252 for which the update failed, after copying the second partial program stored in the first partial area to the second storage area 242, the update is performed. The second partial program is updated to the first partial program by using the partial data corresponding to the second partial program in the data. The update control unit 221 performs this process in the same manner as the process of updating the first program to the second program. The same applies to the provision process by the provision unit 222 at this time.
　次に、更新制御部２２１による第１プログラムを第２プログラムに更新する更新処理中に更新処理が失敗した場合に行う、更新前の状態に戻す処理（ロールバック処理）の第３の例について説明する。第３の例は、第１の例の処理と第２の例の処理とを失敗が発生した第１部分領域の位置に応じて切り替える例である。 Next, a third example of a process (rollback process) for returning to the state before the update, which is performed when the update process fails during the update process for updating the first program to the second program by the update control unit 221, will be described. do. The third example is an example in which the processing of the first example and the processing of the second example are switched according to the position of the first partial region where the failure has occurred.
　具体的には、更新制御部２２１は、第１プログラムを更新している間に当該更新が失敗した場合、更新が失敗した第１部分領域が複数の第１部分領域２５１～２５５のうちの特定の第１部分領域２５３より処理順で前か後かを判定する。そして、更新制御部２２１は、判定の結果、更新が失敗した第１部分領域が処理順で特定の第１部分領域２５３より前である場合、図８で説明した第２の例の処理を行う。一方で、更新制御部２２１は、判定の結果、更新が失敗した第１部分領域が処理順で特定の第１部分領域２５３より後である場合、図７で説明した第１の例の処理を行う。 Specifically, when the update fails while the update control unit 221 is updating the first program, the update control unit 221 identifies the first subregions for which the update failed from among a plurality of first subregions 251 to 255. From the first subregion 253 of the above, it is determined whether it is before or after in the processing order. Then, the update control unit 221 performs the process of the second example described with reference to FIG. 8 when the first subregion in which the update failed as a result of the determination is before the specific first subregion 253 in the processing order. .. On the other hand, when the update control unit 221 determines that the first subregion in which the update failed is later than the specific first subregion 253 in the processing order, the update control unit 221 performs the processing of the first example described with reference to FIG. conduct.
　なお、更新制御部２２１は、判定の結果、更新が失敗した第１部分領域が処理順で特定の第１部分領域２５３である場合、第１の例の処理を行ってもよいし、第２の例の処理を行ってもよい。この場合、第１の例の処理を行うか、第２の例の処理を行うかは予め定められていてもよく、更新制御部２２１は、第１の例の処理および第２の例の処理のうちで予め定められた処理を行う。また、特定の第１部分領域は、複数の第１部分領域２５１～２５５のうちの第１部分領域２５３であることを例示したが、第１部分領域２５３であることに限らない。特定の第１部分領域は、複数の第１部分領域のうちの予め定められた第１部分領域であればよい。 When the update control unit 221 determines that the first subregion for which the update has failed is the specific first subregion 253 in the processing order, the update control unit 221 may perform the processing of the first example, or the second. You may perform the processing of the example of. In this case, whether to perform the processing of the first example or the processing of the second example may be predetermined, and the update control unit 221 processes the processing of the first example and the processing of the second example. Performs a predetermined process. Further, although it has been illustrated that the specific first partial region is the first partial region 253 of the plurality of first partial regions 251 to 255, it is not limited to the first partial region 253. The specific first partial region may be a predetermined first partial region among the plurality of first partial regions.
　［動作］
　以上のように構成された情報処理装置２１０について、その動作を以下に説明する。 [motion]
The operation of the information processing apparatus 210 configured as described above will be described below.
　まず、更新処理について説明する。図９は、実施の形態に係る情報処理装置２１０による更新処理の一例を示すフローチャートである。 First, the update process will be explained. FIG. 9 is a flowchart showing an example of the update process by the information processing apparatus 210 according to the embodiment.
　管理ＥＣＵ２２０は、更新用データを取得したか否かを判定する（Ｓ１１）。 The management ECU 220 determines whether or not the update data has been acquired (S11).
　管理ＥＣＵ２２０は、更新用データを取得したと判定した場合（Ｓ１１でＹｅｓ）、複数の第１部分領域２５１～２５５のそれぞれについて、下記のステップＳ１２およびステップＳ１３を含むループ１を行う。一方で、管理ＥＣＵ２２０は、更新用データを取得していないと判定した場合（Ｓ１１でＮｏ）、ステップＳ１１に戻る。 When the management ECU 220 determines that the update data has been acquired (Yes in S11), the management ECU 220 performs loop 1 including the following steps S12 and S13 for each of the plurality of first partial regions 251 to 255. On the other hand, when the management ECU 220 determines that the update data has not been acquired (No in S11), the management ECU 220 returns to step S11.
　管理ＥＣＵ２２０は、処理対象の第１部分領域に格納されている第１部分プログラムを第２記憶領域２４２にコピーする（Ｓ１２）。 The management ECU 220 copies the first partial program stored in the first partial area to be processed to the second storage area 242 (S12).
　管理ＥＣＵ２２０は、処理対象の第１部分領域に格納されている第１部分プログラムを、更新用データのうちで当該第１部分プログラムに対応する部分データを用いて、第２部分プログラムに更新する（Ｓ１３）。 The management ECU 220 updates the first partial program stored in the first partial area to be processed to the second partial program by using the partial data corresponding to the first partial program among the update data (the partial data corresponding to the first partial program is used). S13).
　管理ＥＣＵ２２０は、全ての第１部分領域２５１～２５５について、ステップＳ１２およびステップＳ１３を実行すると、処理を終了する。 When the management ECU 220 executes steps S12 and S13 for all the first subregions 251 to 255, the process ends.
　次に、提供処理について説明する。図１０は、実施の形態に係る情報処理装置２１０による提供処理の一例を示すフローチャートである。 Next, the provision process will be described. FIG. 10 is a flowchart showing an example of the provision process by the information processing apparatus 210 according to the embodiment.
　管理ＥＣＵ２２０は、ＥＣＵ２３０により仮想ストレージ２６０へアクセスを受け付けたか否かを判定する（Ｓ２１）。 The management ECU 220 determines whether or not the ECU 230 has received access to the virtual storage 260 (S21).
　管理ＥＣＵ２２０は、ＥＣＵ２３０により仮想ストレージ２６０へアクセスを受け付けたと判定した場合（Ｓ２１でＹｅｓ）、アクセス先の第１部分領域の更新状態を判定する（Ｓ２２）。管理ＥＣＵ２２０は、ＥＣＵ２３０により仮想ストレージ２６０へアクセスを受け付けていないと判定した場合（Ｓ２１でＮｏ）、ステップＳ２１に戻る。 When the management ECU 220 determines that the ECU 230 has accepted the access to the virtual storage 260 (Yes in S21), the management ECU 220 determines the update state of the first partial area of the access destination (S22). When the management ECU 220 determines that the ECU 230 is not accepting access to the virtual storage 260 (No in S21), the management ECU 220 returns to step S21.
　管理ＥＣＵ２２０は、アクセス先の第１部分領域の更新状態が更新処理後（更新完了）を示す場合（Ｓ２２で更新完了）、ステップＳ２３を行う。管理ＥＣＵ２２０は、アクセス先の第１部分領域の更新状態が更新中を示す場合（Ｓ２２で更新中）、ステップＳ２４を行う。管理ＥＣＵ２２０は、アクセス先の第１部分領域の更新状態が更新前（未更新）を示す場合（Ｓ２２で更新前）、ステップＳ２６を行う。 The management ECU 220 performs step S23 when the update status of the first partial area of the access destination indicates that the update process has been completed (update completed) (update completed in S22). When the update state of the first partial area of the access destination indicates that it is being updated (during update in S22), the management ECU 220 performs step S24. When the update state of the first partial area of the access destination indicates before update (not updated) (before update in S22), the management ECU 220 performs step S26.
　ステップＳ２３では、管理ＥＣＵ２２０は、アクセス先の第１部分領域に格納されている第２部分プログラムをＥＣＵ２３０に提供する（Ｓ２３）。 In step S23, the management ECU 220 provides the ECU 230 with a second partial program stored in the first partial area of the access destination (S23).
　ステップＳ２４では、管理ＥＣＵ２２０は、第２記憶領域２４２に格納されている第１部分プログラムと、当該第１部分プログラムに対応する差分データとを用いて、第２部分プログラムを生成する（Ｓ２４）。そして、管理ＥＣＵ２２０は、生成した第２部分プログラムをＥＣＵ２３０に提供する（Ｓ２５）。 In step S24, the management ECU 220 generates a second partial program using the first partial program stored in the second storage area 242 and the difference data corresponding to the first partial program (S24). Then, the management ECU 220 provides the generated second partial program to the ECU 230 (S25).
　ステップＳ２６では、管理ＥＣＵ２２０は、アクセス先の第１部分領域に格納されている第１部分プログラムと、当該第１部分プログラムに対応する差分データとを用いて、第２部分プログラムを生成する（Ｓ２６）。そして、管理ＥＣＵ２２０は、生成した第２部分プログラムをＥＣＵ２３０に提供する（Ｓ２７）。 In step S26, the management ECU 220 generates a second partial program using the first partial program stored in the first partial region of the access destination and the difference data corresponding to the first partial program (S26). ). Then, the management ECU 220 provides the generated second partial program to the ECU 230 (S27).
　次に、更新処理が途中で失敗したときの更新前の状態に戻す処理（ロールバック処理）の第１の例について説明する。図１１は、実施の形態に係る情報処理装置２１０によるロールバック処理の第１の例を示すフローチャートである。 Next, the first example of the process (rollback process) of returning to the state before the update when the update process fails in the middle will be described. FIG. 11 is a flowchart showing a first example of rollback processing by the information processing apparatus 210 according to the embodiment.
　管理ＥＣＵ２２０は、更新処理中において更新に失敗したか否かを判定する（Ｓ３１）。例えば、管理ＥＣＵ２２０は、ステップＳ３１の処理において、更新用データに破損が生じた場合、記憶部２４０に物理的な劣化などによる書き込み不能領域が発生した場合、更新処理の異常中断が発生した場合などに、更新に失敗したと判定する。管理ＥＣＵ２２０は、例えば、更新用データを記憶部２４０から取得できない場合、更新用データを更新処理に適用できない場合に、更新用データに破損が生じたと判定することができる。管理ＥＣＵ２２０は、例えば、更新処理中にエラーが検出された場合に、記憶部２４０に物理的な劣化などによる書き込み不能領域が発生したと判定することができる。管理ＥＣＵ２２０は、例えば、更新処理中にエラーが検出された場合、更新処理再開後の書き込み済みプログラム内容の確認が行われた場合に、更新処理の異常中断が発生したと判定することができる。 The management ECU 220 determines whether or not the update has failed during the update process (S31). For example, in the process of step S31, the management ECU 220 may have damage to the update data, a non-writable area due to physical deterioration of the storage unit 240, or an abnormal interruption of the update process. In addition, it is determined that the update has failed. The management ECU 220 can determine that the update data has been damaged, for example, when the update data cannot be acquired from the storage unit 240 or when the update data cannot be applied to the update process. For example, when an error is detected during the update process, the management ECU 220 can determine that a non-writable area has occurred in the storage unit 240 due to physical deterioration or the like. For example, when an error is detected during the update process, the management ECU 220 can determine that an abnormal interruption of the update process has occurred when the contents of the written program after the update process is restarted are confirmed.
　なお、例えば、管理ＥＣＵ２２０は、以下の場合に、更新に失敗するおそれがある。更新に失敗するおそれがある場合とは、例えば、更新用データの受信時に突発的な電源断が発生した場合、ストレージ２３の物理的な劣化などによる書き込み不能領域が発生した場合、書き込み不能領域へのエラーチェック前アクセスが発生した場合、処理負荷が所定の負荷を超えた場合などである。 Note that, for example, the management ECU 220 may fail to update in the following cases. When there is a risk of update failure, for example, when a sudden power failure occurs when receiving update data, or when a non-writable area occurs due to physical deterioration of the storage 23, the non-writable area is entered. When access before error check occurs, or when the processing load exceeds a predetermined load.
　管理ＥＣＵ２２０は、図９で説明した更新処理中において更新に失敗したと判定した場合（Ｓ３１でＹｅｓ）、更新処理中の第１部分領域があるか否かを判定する（Ｓ３２）。一方で、管理ＥＣＵ２２０は、更新処理中において更新に失敗していないと判定した場合（Ｓ３１でＮｏ）、ステップＳ３１に戻る。なお、この場合、図９で説明した更新処理は継続される。 When the management ECU 220 determines that the update has failed during the update process described with reference to FIG. 9 (Yes in S31), the management ECU 220 determines whether or not there is a first partial area during the update process (S32). On the other hand, when the management ECU 220 determines that the update has not failed during the update process (No in S31), the management ECU 220 returns to step S31. In this case, the update process described with reference to FIG. 9 is continued.
　管理ＥＣＵ２２０は、更新処理中の第１部分領域があると判定した場合（Ｓ３２でＹｅｓ）、第２記憶領域２４２に格納している第１部分プログラムを、更新処理中の第１部分領域に格納する（Ｓ３３）。更新中領域への書き込み失敗等の場合、第１部分領域に存在しているデータが更新前か更新後の状態かがわからない、または、当該データが破損している可能性がある。このため、ステップＳ３２およびＳ３３の処理を行うことで、更新中領域を第１部分プログラムに確実に書き戻すことができ、次処理を確実に実施することができる。 When the management ECU 220 determines that there is a first partial area during the update process (Yes in S32), the management ECU 220 stores the first partial program stored in the second storage area 242 in the first partial area during the update process. (S33). In the case of failure to write to the area being updated, it is possible that it is not known whether the data existing in the first partial area is in the state before or after the update, or the data is damaged. Therefore, by performing the processes of steps S32 and S33, the area being updated can be reliably written back to the first subprogram, and the next process can be reliably executed.
　管理ＥＣＵ２２０は、更新処理中の第１部分領域がないと判定した場合（Ｓ３２でＮｏ）、または、ステップＳ３３の後、更新処理前（未処理）の第１部分領域があるか否かを判定する（Ｓ３４）。 The management ECU 220 determines whether or not there is a first partial area during the update process (No in S32), or after step S33 and before the update process (unprocessed). (S34).
　管理ＥＣＵ２２０は、更新処理前の第１部分領域があると判定した場合（Ｓ３４でＹｅｓ）、更新処理前の第１部分領域のそれぞれについて、下記のステップＳ３５およびステップＳ３６を含むループ２を行う。 When the management ECU 220 determines that there is a first partial area before the update process (Yes in S34), the management ECU 220 performs a loop 2 including the following steps S35 and S36 for each of the first partial areas before the update process.
　管理ＥＣＵ２２０は、処理対象の第１部分領域に格納されている第１部分プログラムを第２記憶領域２４２にコピーする（Ｓ３５）。 The management ECU 220 copies the first partial program stored in the first partial area to be processed to the second storage area 242 (S35).
　管理ＥＣＵ２２０は、処理対象の第１部分領域に格納されている第１部分プログラムを、更新用データのうちで当該第１部分プログラムに対応する部分データを用いて、第２部分プログラムに更新する（Ｓ３６）。 The management ECU 220 updates the first partial program stored in the first partial area to be processed to the second partial program by using the partial data corresponding to the first partial program among the update data (the partial data corresponding to the first partial program is used). S36).
　管理ＥＣＵ２２０は、更新処理前の第１部分領域がないと判定した場合（Ｓ３４でＮｏ）、または、更新処理前の全ての第１部分領域について、ステップＳ３５およびステップＳ３６を実行した場合、更新処理後の全ての第１部分領域２５１～２５５のそれぞれについて、ステップＳ３７およびステップＳ３８を含むループ３を行う。 When the management ECU 220 determines that there is no first partial area before the update process (No in S34), or when steps S35 and S36 are executed for all the first partial areas before the update process, the update process For each of the subsequent first partial regions 251 to 255, loop 3 including step S37 and step S38 is performed.
　管理ＥＣＵ２２０は、処理対象の第１部分領域に格納されている第２部分プログラムを第２記憶領域２４２にコピーする（Ｓ３７）。 The management ECU 220 copies the second partial program stored in the first partial area to be processed to the second storage area 242 (S37).
　管理ＥＣＵ２２０は、処理対象の第１部分領域に格納されている第２部分プログラムを、更新用データのうちで当該第２部分プログラムに対応する部分データを用いて、第１部分プログラムに更新する（Ｓ３８）。 The management ECU 220 updates the second partial program stored in the first partial area to be processed to the first partial program by using the partial data corresponding to the second partial program among the update data (the secondary partial program). S38).
　管理ＥＣＵ２２０は、全ての第１部分領域２５１～２５５について、ステップＳ３７およびステップＳ３８を実行すると、処理を終了する。 When the management ECU 220 executes steps S37 and S38 for all the first subregions 251 to 255, the process ends.
　これにより、更新処理中において第１プログラムから第２プログラムへの更新が失敗した場合であっても、第１記憶領域２４１に第１プログラムが格納されている状態に戻すことができる。 As a result, even if the update from the first program to the second program fails during the update process, it is possible to return to the state in which the first program is stored in the first storage area 241.
　次に、更新処理が途中で失敗したときの更新前の状態に戻す処理（ロールバック処理）の第２の例について説明する。図１２は、実施の形態に係る情報処理装置２１０によるロールバック処理の第２の例を示すフローチャートである。 Next, a second example of a process (rollback process) for returning to the state before the update when the update process fails in the middle will be described. FIG. 12 is a flowchart showing a second example of rollback processing by the information processing apparatus 210 according to the embodiment.
　管理ＥＣＵ２２０は、ステップＳ３１～Ｓ３３と同じ処理を行う。 The management ECU 220 performs the same processing as in steps S31 to S33.
　管理ＥＣＵ２２０は、更新処理中の第１部分領域がないと判定した場合（Ｓ３２でＮｏ）、または、ステップＳ３３の後、更新済みの１以上の第１部分領域と、更新が失敗した第１部分領域とのそれぞれについて、下記のステップＳ４１およびステップＳ４２を含むループ４を行う。 When the management ECU 220 determines that there is no first partial area during the update process (No in S32), or after step S33, one or more first partial areas that have been updated and the first portion for which the update has failed For each of the regions, a loop 4 including the following steps S41 and S42 is performed.
　管理ＥＣＵ２２０は、処理対象の第１部分領域に格納されている第２部分プログラムを第２記憶領域２４２にコピーする（Ｓ４１）。 The management ECU 220 copies the second partial program stored in the first partial area to be processed to the second storage area 242 (S41).
　管理ＥＣＵ２２０は、処理対象の第１部分領域に格納されている第２部分プログラムを、更新用データのうちで当該第２部分プログラムに対応する部分データを用いて、第１部分プログラムに更新する（Ｓ４２）。 The management ECU 220 updates the second partial program stored in the first partial area to be processed to the first partial program by using the partial data corresponding to the second partial program among the update data (the secondary partial program). S42).
　管理ＥＣＵ２２０は、全ての更新済みの第１部分領域と、更新が失敗した第１部分領域とについて、ステップＳ４１およびステップＳ４１を実行すると、処理を終了する。 When the management ECU 220 executes step S41 and step S41 for all the updated first partial areas and the first partial area for which the update has failed, the process ends.
　これにより、更新処理中において第１プログラムから第２プログラムへの更新が失敗した場合であっても、第１記憶領域２４１に第１プログラムが格納されている状態に戻すことができる。 As a result, even if the update from the first program to the second program fails during the update process, it is possible to return to the state in which the first program is stored in the first storage area 241.
　次に、更新処理が途中で失敗したときの更新前の状態に戻す処理（ロールバック処理）の第３の例について説明する。図１３は、実施の形態に係る情報処理装置２１０によるロールバック処理の第３の例を示すフローチャートである。 Next, a third example of the process of returning to the state before the update (rollback process) when the update process fails in the middle will be described. FIG. 13 is a flowchart showing a third example of rollback processing by the information processing apparatus 210 according to the embodiment.
　管理ＥＣＵ２２０は、ステップＳ３１～Ｓ３３と同じ処理を行う。 The management ECU 220 performs the same processing as in steps S31 to S33.
　管理ＥＣＵ２２０は、更新処理中の第１部分領域がないと判定した場合（Ｓ３２でＮｏ）、または、ステップＳ３３の後、更新が失敗した第１部分領域が複数の第１部分領域２５１～２５５のうちの特定の第１部分領域２５３より処理順で前か後かを判定する（Ｓ５１）。 When the management ECU 220 determines that there is no first partial region during the update process (No in S32), or after step S33, the first partial region for which the update failed is a plurality of first partial regions 251 to 255. From the specific first partial region 253, it is determined whether it is before or after in the processing order (S51).
　管理ＥＣＵ２２０は、更新が失敗した第１部分領域が複数の第１部分領域２５１～２５５のうちの特定の第１部分領域２５３より処理順で前であると判定した場合（Ｓ５１で前）、更新済みの１以上の第１部分領域と、更新が失敗した第１部分領域とのそれぞれについて、下記のステップＳ４１およびステップＳ４２を含むループ４を行う。ループ４については、図１２を用いて既に説明したため、説明を省略する。 When the management ECU 220 determines that the first partial region for which the update has failed is ahead of the specific first partial region 253 of the plurality of first partial regions 251 to 255 in the processing order (previous in S51), the update is performed. A loop 4 including the following steps S41 and S42 is performed for each of the one or more first subregions that have been completed and the first subregion that has failed to be updated. Since the loop 4 has already been described with reference to FIG. 12, the description thereof will be omitted.
　管理ＥＣＵ２２０は、更新が失敗した第１部分領域が複数の第１部分領域２５１～２５５のうちの特定の第１部分領域２５３より処理順で後であると判定した場合（Ｓ５１で後）、ステップＳ３４～ステップＳ３８と同じ処理を行う。 When the management ECU 220 determines that the first partial region for which the update has failed is later in the processing order than the specific first partial region 253 of the plurality of first partial regions 251 to 255 (after in S51), the step. The same processing as in steps S34 to S38 is performed.
　これにより、更新処理中において第１プログラムから第２プログラムへの更新が失敗した場合であっても、失敗した第１部分領域の位置に応じて、処理を変更するため、処理に要する時間を低減することができる。 As a result, even if the update from the first program to the second program fails during the update process, the process is changed according to the position of the failed first partial area, so that the time required for the process is reduced. can do.
　［効果など］
　本実施の形態に係る情報処理装置２１０によれば、更新処理の対象となる第１部分領域に格納されている第１部分プログラムを第２記憶領域２４２にコピーすることで第１部分プログラムを退避させた上で、当該第１部分領域に格納されている第１部分プログラムを第２部分プログラムに更新する。このため、更新処理中の第１部分領域にアクセスされた場合であっても、更新処理中の第１部分プログラムの代わりに退避させた第１部分プログラムを用いることができ、アクセス元の機器にプログラムを提供することができる。また、更新に用いられるデータは差分情報であり、かつ、退避させるプログラムは第１プログラムの一部の第１部分プログラムであるため、プログラムの更新時に使用するストレージの記憶容量を低減することができる。 [Effects, etc.]
According to the information processing apparatus 210 according to the present embodiment, the first partial program is saved by copying the first partial program stored in the first partial area to be updated to the second storage area 242. Then, the first partial program stored in the first partial area is updated to the second partial program. Therefore, even when the first partial area during the update process is accessed, the saved first partial program can be used instead of the first partial program during the update process, and the access source device can be used. A program can be provided. Further, since the data used for the update is the difference information and the program to be saved is the first part program of a part of the first program, the storage capacity of the storage used at the time of updating the program can be reduced. ..
　また、本実施の形態に係る情報処理装置２１０において、ＥＣＵ２３０と、更新制御部２２１、および、記憶部２４０を仮想ストレージ２６０としてＥＣＵ２３０に提供する提供部２２２とを有する管理ＥＣＵ２２０と、を備え、第１プログラムは、ＥＣＵ２３０が起動時に実行するプログラムである。つまり、ＥＣＵ２３０が実行する第１プログラムは、管理ＥＣＵ２２０が提供する仮想ストレージ２６０に格納されているため、ＥＣＵ２３０のプログラムの更新を、ＥＣＵ２３０を用いずに行うことができる。よって、更新対象のＥＣＵ２３０のプログラムをＥＣＵ２３０の動作に影響を与えないように更新することができる。 Further, the information processing device 210 according to the present embodiment includes an ECU 230, an update control unit 221 and a management ECU 220 having a storage unit 240 as a virtual storage 260 and a providing unit 222. 1 program is a program executed by the ECU 230 at startup. That is, since the first program executed by the ECU 230 is stored in the virtual storage 260 provided by the management ECU 220, the program of the ECU 230 can be updated without using the ECU 230. Therefore, the program of the ECU 230 to be updated can be updated so as not to affect the operation of the ECU 230.
　また、本実施の形態に係る情報処理装置２１０において、差分情報は、第１プログラムを構成する複数の第１データ単位、および、第２プログラムを構成する複数の第２データ単位の間の差分を示す複数の差分データと、複数の差分データ毎に、当該差分データに対応する第１データ単位及び第２データ単位を特定するための対応関係情報とを含む。このため、差分データを適用する第１データ単位を容易に特定することができる。よって、第２部分プログラムの生成処理に係る処理負荷、および、当該生成処理に係る処理時間を低減することができる。 Further, in the information processing apparatus 210 according to the present embodiment, the difference information is a difference between a plurality of first data units constituting the first program and a plurality of second data units constituting the second program. The plurality of difference data to be shown and the correspondence information for specifying the first data unit and the second data unit corresponding to the difference data are included in each of the plurality of difference data. Therefore, the first data unit to which the difference data is applied can be easily specified. Therefore, the processing load related to the generation process of the second subprogram and the processing time related to the generation process can be reduced.
　［変形例］
　（変形例１）
　上記実施の形態では、管理ＥＣＵ２２０と、ＥＣＵ２３０とは、ｎ個のＥＣＵ２２のうちのいずれかで実現されるとしたが、これに限らずに、１以上のプロセッサ、および、仮想化環境を実現するためのプログラムが格納されているメモリまたはストレージにより実現されてもよい。 [Modification example]
(Modification example 1)
In the above embodiment, the management ECU 220 and the ECU 230 are realized by any one of n ECUs 22, but the present invention is not limited to this, and one or more processors and a virtualized environment are realized. It may be realized by the memory or storage in which the program for the purpose is stored.
　図１４は、変形例１に係る情報処理装置２１０Ａの機能構成の一例を示すブロック図である。図１５は、変形例１に係る情報処理装置２１０Ａの機能を実現する仮想マシンの構成を示す図である。 FIG. 14 is a block diagram showing an example of the functional configuration of the information processing device 210A according to the first modification. FIG. 15 is a diagram showing a configuration of a virtual machine that realizes the function of the information processing device 210A according to the first modification.
　情報処理装置２１０Ａは、図１４に示すように、管理ＶＭ（Ｖｉｒｔｕａｌ　Ｍａｃｈｉｎｅ）２２０Ａと、複数のＶＭ（Ｖｉｒｔｕａｌ　Ｍａｃｈｉｎｅ）２３０Ａａ、２３０Ａｂと、共有メモリ２５０とを備える。情報処理装置２１０Ａは、図１５に示すように、１以上のハードウェアの上にソフトウェアにより仮想的に実現される仮想マシンを有する。例えば、情報処理装置２１０Ａは、ハイパーバイザー型の仮想化環境で実現される。 As shown in FIG. 14, the information processing device 210A includes a management VM (Virtual Machine) 220A, a plurality of VMs (Virtual Machine) 230Aa and 230Ab, and a shared memory 250. As shown in FIG. 15, the information processing device 210A has a virtual machine virtually realized by software on one or more hardware. For example, the information processing device 210A is realized in a hypervisor type virtual environment.
　管理ＶＭ２２０Ａは、実施の形態に係る管理ＥＣＵ２２０と同様の機能を有する。複数のＶＭ２３０Ａａ、２３０Ａｂは、実施の形態に係るＥＣＵ２３０と同様の機能を有する。 The management VM 220A has the same function as the management ECU 220 according to the embodiment. The plurality of VM230Aa and 230Ab have the same functions as the ECU 230 according to the embodiment.
　共有メモリ２５０は、仮想ストレージ機能による記憶領域を提供する。このように、共有メモリ２５０により、各ＶＭのプログラムの記憶領域が実現されているため、管理ＶＭ２２０ＡおよびＶＭ２３０Ａａ、２３０Ａｂ間の情報の受け渡しを高速に行うことができる。 The shared memory 250 provides a storage area by the virtual storage function. In this way, since the storage area of the program of each VM is realized by the shared memory 250, information can be exchanged between the management VM 220A and the VM 230Aa and 230Ab at high speed.
　（変形例２）
　上記実施の形態では、自動車２００を移動体の一例として挙げたが、移動体は、自動車２００に限らずに、他の乗り物であってもよいし、無人の車両、ドローンなどの飛行体などであってもよい。また、情報処理装置２１０は、例えば、移動体に搭載されるコンピュータシステムに限らずに、複数の制御器を備えていればどのようなコンピュータシステムに適用されてもよい。 (Modification 2)
In the above embodiment, the automobile 200 is given as an example of the moving body, but the moving body is not limited to the automobile 200, but may be another vehicle, an unmanned vehicle, a flying object such as a drone, or the like. There may be. Further, the information processing device 210 is not limited to, for example, a computer system mounted on a mobile body, and may be applied to any computer system as long as it has a plurality of controls.
　［その他］
　なお、上記実施の形態およびその変形例１および２において、各構成要素は、専用のハードウェアで構成されるか、各構成要素に適したソフトウェアプログラムを実行することによって実現されてもよい。各構成要素は、ＣＰＵまたはプロセッサなどのプログラム実行部が、ハードディスクまたは半導体メモリなどの記録媒体に記録されたソフトウェアプログラムを読み出して実行することによって実現されてもよい。ここで、上記各実施の形態のプログラム更新方法などを実現するソフトウェアは、次のようなプログラムである。 [others]
In the above-described embodiment and modifications 1 and 2 thereof, each component may be configured by dedicated hardware or may be realized by executing a software program suitable for each component. Each component may be realized by a program execution unit such as a CPU or a processor reading and executing a software program recorded on a recording medium such as a hard disk or a semiconductor memory. Here, the software that realizes the program update method of each of the above embodiments is the following program.
　すなわち、このプログラムは、コンピュータに、第１プログラムが格納されている記憶部を備える情報処理装置により実行される情報処理方法であって、外部装置から前記第１プログラムの更新用のデータを取得し、取得した前記データを用いて前記第１プログラムを新たな第２プログラムに更新し、前記更新では、前記第１プログラムが格納されている前記記憶部の記憶領域である第１記憶領域が分割された複数の第１部分領域のそれぞれについて、当該第１部分領域に格納されている前記第１プログラムの一部である第１部分プログラムを前記第１記憶領域とは異なる第２記憶領域にコピーした後で、前記データのうちで前記第１部分プログラムに対応する部分データを用いて前記第１部分プログラムを前記第２プログラムの一部である第２部分プログラムに順次更新し、前記データは、前記第１プログラムと前記第２プログラムとの間の差分を示す差分情報であり、前記第２記憶領域の記憶容量は、前記第１記憶領域の記憶容量よりも小さい情報処理方法を実行させる。 That is, this program is an information processing method executed by an information processing device including a storage unit in which the first program is stored in a computer, and acquires data for updating the first program from an external device. The first program is updated to a new second program using the acquired data, and in the update, the first storage area, which is the storage area of the storage unit in which the first program is stored, is divided. For each of the plurality of first partial areas, the first partial program, which is a part of the first program stored in the first partial area, is copied to a second storage area different from the first storage area. Later, the first partial program is sequentially updated to the second partial program which is a part of the second program by using the partial data corresponding to the first partial program in the data, and the data is obtained as described above. It is the difference information indicating the difference between the first program and the second program, and the storage capacity of the second storage area is smaller than the storage capacity of the first storage area to execute an information processing method.
　以上のように、本開示における技術の例示として、実施の形態を説明した。そのために、添付図面および詳細な説明を提供した。 As described above, an embodiment has been described as an example of the technology in the present disclosure. To that end, the accompanying drawings and detailed description are provided.
　したがって、添付図面および詳細な説明に記載された構成要素の中には、課題解決のために必須な構成要素だけでなく、上記技術を例示するために、課題解決のためには必須でない構成要素も含まれ得る。そのため、それらの必須ではない構成要素が添付図面や詳細な説明に記載されていることをもって、直ちに、それらの必須ではない構成要素が必須であるとの認定をするべきではない。 Therefore, among the components described in the attached drawings and the detailed description, not only the components essential for solving the problem but also the components not essential for solving the problem in order to exemplify the above technology. Can also be included. Therefore, the fact that those non-essential components are described in the accompanying drawings and detailed description should not immediately determine that those non-essential components are essential.
　また、上述の実施の形態は、本開示における技術を例示するためのものであるから、請求の範囲またはその均等の範囲において種々の変更、置き換え、付加、省略などを行うことができる。 Further, since the above-described embodiment is for exemplifying the technology in the present disclosure, various changes, replacements, additions, omissions, etc. can be made within the scope of claims or the equivalent scope thereof.
　本開示は、更新対象の制御器のプログラムを当該制御器に影響を与えないように更新することができる情報処理装置等に適用可能である。 The present disclosure is applicable to an information processing device or the like that can update the program of the control to be updated so as not to affect the control.
　１１　　ＣＰＵ（Ｃｅｎｔｒａｌ　Ｐｒｏｃｅｓｓｉｎｇ　Ｕｎｉｔ）
　１２　　メインメモリ
　１３　　ストレージ
　１４　　通信ＩＦ（Ｉｎｔｅｒｆａｃｅ）
　２１　　ＴＣＵ（Ｔｅｌｅｍａｔｉｃｓ　Ｃｏｎｔｒｏｌ　Ｕｎｉｔ）
　２２　　ＥＣＵ（Ｅｌｅｃｔｒｏｎｉｃ　Ｃｏｎｔｒｏｌ　Ｕｎｉｔ）
　２３　　ストレージ
１００　　サーバ
２００　　自動車
２１０、２１０Ａ　　情報処理装置
２２０　　管理ＥＣＵ
２２０Ａ　　管理ＶＭ
２２１　　更新制御部
２２２　　提供部
２３０　　ＥＣＵ
２３０Ａａ、２３０Ａｂ　　ＶＭ
２３１　　制御部
２３２　　クライアント部
２４０　　記憶部
２４１　　第１記憶領域
２４２　　第２記憶領域
２４３　　第３記憶領域
２５０　　共有メモリ
２５１～２５５　　第１部分領域
２６０　　仮想ストレージ
３００　　通信ネットワーク
３１０　　基地局 11 CPU (Central Processing Unit)
12 Main memory 13 Storage 14 Communication IF (Interface)
21 TCU (Telematics Control Unit)
22 ECU (Electronic Control Unit)
23 Storage 100 Server 200 Automobile 210, 210A Information processing device 220 Management ECU
220A management VM
221 Update control unit 222 Provision unit 230 ECU
230Aa, 230Ab VM
231 Control unit 232 Client unit 240 Storage unit 241 1st storage area 242 2nd storage area 243 3rd storage area 250 Shared memory 251 to 255 1st partial area 260 Virtual storage 300 Communication network 310 Base station

Claims (8)

  1. 　第１プログラムが格納されている記憶部と、
    　外部装置から前記第１プログラムの更新用のデータを取得し、取得した前記データを用いて前記第１プログラムを新たな第２プログラムに更新する更新制御部と、を備え、
    　前記更新制御部は、前記第１プログラムが格納されている前記記憶部の記憶領域である第１記憶領域が分割された複数の第１部分領域のそれぞれについて、当該第１部分領域に格納されている前記第１プログラムの一部である第１部分プログラムを前記第１記憶領域とは異なる第２記憶領域にコピーした後で、前記データのうちで前記第１部分プログラムに対応する部分データを用いて前記第１部分プログラムを前記第２プログラムの一部である第２部分プログラムに順次更新し、
    　前記データは、前記第１プログラムと前記第２プログラムとの間の差分を示す差分情報であり、
    　前記第２記憶領域の記憶容量は、前記第１記憶領域の記憶容量よりも小さい
    　情報処理装置。     The storage unit where the first program is stored and
    It is provided with an update control unit that acquires data for updating the first program from an external device and updates the first program to a new second program using the acquired data.
    The update control unit is stored in the first partial area for each of a plurality of first partial areas in which the first storage area, which is the storage area of the storage unit in which the first program is stored, is divided. After copying the first partial program that is a part of the first partial program to a second storage area different from the first storage area, the partial data corresponding to the first partial program is used among the data. The first partial program is sequentially updated to the second partial program which is a part of the second program.
    The data is difference information indicating a difference between the first program and the second program.
    An information processing device in which the storage capacity of the second storage area is smaller than the storage capacity of the first storage area.
  2. 　さらに、
    　第１制御器と、
    　前記更新制御部と、前記記憶部を仮想ストレージとして前記第１制御器に提供する提供部とを有する第２制御器と、を備え、
    　前記第１プログラムは、前記第１制御器が起動時に実行するプログラムである
    　請求項１に記載の情報処理装置。     Moreover,
    The first controller and
    A second controller having the update control unit and a providing unit that provides the storage unit as virtual storage to the first control unit is provided.
    The information processing apparatus according to claim 1, wherein the first program is a program executed by the first controller at startup.
  3. 　前記提供部は、前記更新制御部が前記第１プログラムを更新している間において、前記第１制御器から前記仮想ストレージへのアクセスを受け付けた場合、
    　（ｉ）前記アクセスのアクセス先が更新処理後の第１部分領域であれば、当該第１部分領域に格納されている前記第２部分プログラムを前記第１制御器に提供し、
    　（ｉｉ）前記アクセス先が更新処理中の第１部分領域であれば、前記第２記憶領域に格納されている第１部分プログラムと、前記データのうちで当該第１部分プログラムに対応する部分データとを用いて、当該第１部分プログラムを更新した第２部分プログラムを生成し、生成した前記第２部分プログラムを前記第１制御器に提供し、
    　（ｉｉｉ）前記アクセス先が更新処理前の第１部分領域であれば、当該第１部分領域に格納されている第１部分プログラムと、前記データのうちで当該第１部分プログラムに対応する部分データとを用いて、当該第１部分プログラムを更新した第２部分プログラムを生成し、生成した前記第２部分プログラムを前記第１制御器に提供する
    　請求項２に記載の情報処理装置。     When the providing unit receives access to the virtual storage from the first control while the update control unit is updating the first program, the providing unit receives access to the virtual storage.
    (I) If the access destination of the access is the first partial area after the update process, the second partial program stored in the first partial area is provided to the first controller.
    (Ii) If the access destination is the first partial area being updated, the first partial program stored in the second storage area and the partial data corresponding to the first partial program among the data. To generate a second partial program in which the first partial program is updated, and provide the generated second partial program to the first controller.
    (Iii) If the access destination is the first partial area before the update process, the first partial program stored in the first partial area and the partial data corresponding to the first partial program in the data. The information processing apparatus according to claim 2, wherein a second partial program in which the first partial program is updated is generated by using the above, and the generated second partial program is provided to the first controller.
  4. 　前記差分情報は、前記第１プログラムを構成する複数の第１データ単位、および、第２プログラムを構成する複数の第２データ単位の間の差分を示す複数の差分データと、前記複数の差分データ毎に、当該差分データに対応する前記第１データ単位及び前記第２データ単位を特定するための対応関係情報とを含む
    　請求項１から３のいずれか１項に記載の情報処理装置。     The difference information includes a plurality of first data units constituting the first program, a plurality of difference data indicating a difference between a plurality of second data units constituting the second program, and the plurality of difference data. The information processing apparatus according to any one of claims 1 to 3, wherein each includes the first data unit corresponding to the difference data and the correspondence information for specifying the second data unit.
  5. 　前記更新制御部は、前記第１プログラムを更新している間に当該更新が失敗した場合、
    　　全ての前記複数の第１部分領域について、当該第１部分領域に格納されている前記第１部分プログラムを前記第２部分プログラムに更新し、
    　　前記第１プログラムを前記第２プログラムに更新した後で、前記第２プログラムが格納されている前記第１記憶領域が分割された前記複数の第１部分領域のそれぞれについて、当該第１部分領域に格納されている前記第２プログラムの一部である前記第２部分プログラムを前記第２記憶領域にコピーし、当該コピーの後で、前記データのうちで前記第２部分プログラムに対応する部分データを用いて前記第２部分プログラムを前記第１プログラムの一部である第１部分プログラムに更新する
    　請求項１から４のいずれか１項に記載の情報処理装置。     When the update control unit fails to update the first program while updating the first program, the update control unit fails to update the program.
    For all the plurality of first partial areas, the first partial program stored in the first partial area is updated to the second partial program.
    After updating the first program to the second program, each of the plurality of first partial areas in which the first storage area in which the second program is stored is divided is placed in the first partial area. The second partial program, which is a part of the second program stored, is copied to the second storage area, and after the copy, the partial data corresponding to the second partial program in the data is transferred. The information processing apparatus according to any one of claims 1 to 4, wherein the second subprogram is used to update the first subprogram to a first subprogram that is a part of the first program.
  6. 　前記更新制御部は、前記第１プログラムを更新している間に当該更新が失敗した場合、更新済みの１以上の前記第１部分領域と、更新が失敗した第１部分領域とのそれぞれについて、当該第１部分領域に格納されている第２プログラムの一部である第２部分プログラムを前記第２記憶領域にコピーした後で、前記データのうちで前記第２部分プログラムに対応する部分データを用いて前記第２部分プログラムを前記第１部分プログラムに更新する
    　請求項１から４のいずれか１項に記載の情報処理装置。     If the update fails while the first program is being updated, the update control unit may use one or more of the updated first partial areas and the first partial area for which the update has failed. After copying the second partial program, which is a part of the second program stored in the first partial area, to the second storage area, the partial data corresponding to the second partial program in the data is transferred. The information processing apparatus according to any one of claims 1 to 4, wherein the second subprogram is updated to the first subprogram by using the information processing apparatus.
  7. 　前記更新制御部は、前記第１プログラムを更新している間に当該更新が失敗した場合、更新が失敗した第１部分領域が前記複数の第１部分領域のうちの特定の第１部分領域より処理順で前か後かを判定し、
    　前記判定の結果、更新が失敗した前記第１部分領域が処理順で前記特定の第１部分領域より前である場合、更新済みの前記複数の第１部分領域と、更新が失敗した第１部分領域とのそれぞれについて、当該第１部分領域に格納されている第２プログラムの一部である第２部分プログラムを前記第２記憶領域にコピーした後で、前記データのうちで前記第２部分プログラムに対応する部分データを用いて前記第２部分プログラムを前記第１部分プログラムに更新し、
    　前記判定の結果、更新が失敗した前記第１部分領域が処理順で前記特定の第１部分領域より後である場合、
    　　全ての前記複数の第１部分領域について、当該第１部分領域に格納されている前記第１部分プログラムを前記第２部分プログラムに更新し、
    　　前記第１プログラムを前記第２プログラムに更新した後で、前記第２プログラムが格納されている第３記憶領域が分割された複数の第２部分領域のそれぞれについて、当該第２部分領域に格納されている第２プログラムの一部である第３部分プログラムを前記第２記憶領域にコピーし、当該コピーの後で、前記データのうちで前記第３部分プログラムに対応する部分データを用いて前記第３部分プログラムを前記第１プログラムの一部である第４部分プログラムに更新する
    　請求項１から４のいずれか１項に記載の情報処理装置。     When the update fails while the update control unit is updating the first program, the first partial area where the update fails is from a specific first partial area among the plurality of first partial areas. Judge whether it is before or after in the processing order,
    As a result of the determination, when the first partial area for which the update has failed is before the specific first partial area in the processing order, the plurality of updated first partial areas and the first portion for which the update has failed For each of the areas, after copying the second part program which is a part of the second program stored in the first part area to the second storage area, the second part program in the data The second partial program is updated to the first partial program using the partial data corresponding to
    As a result of the determination, when the first subregion for which the update has failed is later than the specific first subregion in the processing order.
    For all the plurality of first partial areas, the first partial program stored in the first partial area is updated to the second partial program.
    After updating the first program to the second program, each of the plurality of second partial areas in which the third storage area in which the second program is stored is divided is stored in the second partial area. The third partial program, which is a part of the second program, is copied to the second storage area, and after the copy, the partial data corresponding to the third partial program in the data is used. 3. The information processing apparatus according to any one of claims 1 to 4, wherein the partial program is updated to the fourth partial program which is a part of the first program.
  8. 　第１プログラムが格納されている記憶部を備える情報処理装置により実行される情報処理方法であって、
    　外部装置から前記第１プログラムの更新用のデータを取得し、
    　取得した前記データを用いて前記第１プログラムを新たな第２プログラムに更新し、
    　前記更新では、前記第１プログラムが格納されている前記記憶部の記憶領域である第１記憶領域が分割された複数の第１部分領域のそれぞれについて、当該第１部分領域に格納されている前記第１プログラムの一部である第１部分プログラムを前記第１記憶領域とは異なる第２記憶領域にコピーした後で、前記データのうちで前記第１部分プログラムに対応する部分データを用いて前記第１部分プログラムを前記第２プログラムの一部である第２部分プログラムに順次更新し、
    　前記データは、前記第１プログラムと前記第２プログラムとの間の差分を示す差分情報であり、
    　前記第２記憶領域の記憶容量は、前記第１記憶領域の記憶容量よりも小さい
    　情報処理方法。     An information processing method executed by an information processing device including a storage unit in which a first program is stored.
    Obtain the data for updating the first program from the external device, and
    Using the acquired data, the first program is updated with a new second program, and the program is updated.
    In the update, each of the plurality of first partial areas in which the first storage area, which is the storage area of the storage unit in which the first program is stored, is divided, is stored in the first partial area. After copying the first partial program, which is a part of the first program, to a second storage area different from the first storage area, the partial data corresponding to the first partial program in the data is used. The first part program is sequentially updated to the second part program which is a part of the second program, and the first part program is sequentially updated.
    The data is difference information indicating a difference between the first program and the second program.
    An information processing method in which the storage capacity of the second storage area is smaller than the storage capacity of the first storage area.
PCT/JP2021/000757 2020-01-31 2021-01-13 Information processing device and information processing method WO2021153224A1 (en)

Priority Applications (2)

Application Number Priority Date Filing Date Title
DE112021000801.3T DE112021000801T5 (en) 2020-01-31 2021-01-13 Information processing device and information processing method
US17/563,833 US11886869B2 (en) 2020-01-31 2021-12-28 Information processing device and information processing method for updating a program by partially relocating the program

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
JP2020014785A JP7266216B2 (en) 2020-01-31 2020-01-31 Information processing device and information processing method
JP2020-014785 2020-01-31

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/563,833 Continuation US11886869B2 (en) 2020-01-31 2021-12-28 Information processing device and information processing method for updating a program by partially relocating the program

Publications (1)

Publication Number Publication Date
WO2021153224A1 true WO2021153224A1 (en) 2021-08-05

Family

ID=77078787

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/JP2021/000757 WO2021153224A1 (en) 2020-01-31 2021-01-13 Information processing device and information processing method

Country Status (4)

Country Link
US (1) US11886869B2 (en)
JP (1) JP7266216B2 (en)
DE (1) DE112021000801T5 (en)
WO (1) WO2021153224A1 (en)

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2014115927A (en) * 2012-12-12 2014-06-26 Sharp Corp Program update device, method, program, and recording medium
JP2014191574A (en) * 2013-03-27 2014-10-06 Denso Corp Electronic control device for vehicle and control program
JP2016033728A (en) * 2014-07-31 2016-03-10 京セラドキュメントソリューションズ株式会社 Information processing device
JP2018018186A (en) * 2016-07-26 2018-02-01 日立オートモティブシステムズ株式会社 Vehicle control device and on-vehicle network system
JP2018197993A (en) * 2017-05-24 2018-12-13 シャープ株式会社 Terminal device, server device, control program for terminal device, control method for server device, and system
JP2019144671A (en) * 2018-02-16 2019-08-29 トヨタ自動車株式会社 Vehicle electronic control unit, program update method and program

Family Cites Families (16)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JPS4856580U (en) 1971-11-01 1973-07-19
JPH0511740Y2 (en) 1987-09-18 1993-03-24
US7096311B2 (en) * 2002-09-30 2006-08-22 Innopath Software, Inc. Updating electronic files using byte-level file differencing and updating algorithms
US7376870B2 (en) * 2004-09-30 2008-05-20 Intel Corporation Self-monitoring and updating of firmware over a network
JP4548601B2 (en) 2005-04-20 2010-09-22 株式会社デンソー Automotive control unit
US20060259207A1 (en) 2005-04-20 2006-11-16 Denso Corporation Electronic control system for automobile
US7802245B2 (en) 2006-04-27 2010-09-21 Agere Systems Inc. Methods and apparatus for performing in-service upgrade of software in network processor
JP5349104B2 (en) 2009-03-25 2013-11-20 富士通株式会社 Electronic device and program update method
JP6386302B2 (en) 2014-08-29 2018-09-05 株式会社スクウェア・エニックス Patch application system, patch application program, patch providing apparatus, and patch application method
JP6447469B2 (en) 2015-11-23 2019-01-09 株式会社デンソー Rewriting system
JP6361671B2 (en) 2016-03-02 2018-07-25 住友電気工業株式会社 Program update system, program update method, relay device, and computer program
JP6699324B2 (en) 2016-04-26 2020-05-27 株式会社デンソー Electronic control device and data rewriting system
KR20180131840A (en) * 2017-06-01 2018-12-11 한국전자통신연구원 Apparatus for supporting firmware update and method for the same
JP6984203B2 (en) 2017-07-13 2021-12-17 株式会社デンソー Electronic control device and update software distribution system
JP7087334B2 (en) 2017-10-13 2022-06-21 株式会社デンソー Electronic control device
US10452386B1 (en) * 2018-07-19 2019-10-22 American Megatrends International, Llc Non-destructive update of discrete components of firmware

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2014115927A (en) * 2012-12-12 2014-06-26 Sharp Corp Program update device, method, program, and recording medium
JP2014191574A (en) * 2013-03-27 2014-10-06 Denso Corp Electronic control device for vehicle and control program
JP2016033728A (en) * 2014-07-31 2016-03-10 京セラドキュメントソリューションズ株式会社 Information processing device
JP2018018186A (en) * 2016-07-26 2018-02-01 日立オートモティブシステムズ株式会社 Vehicle control device and on-vehicle network system
JP2018197993A (en) * 2017-05-24 2018-12-13 シャープ株式会社 Terminal device, server device, control program for terminal device, control method for server device, and system
JP2019144671A (en) * 2018-02-16 2019-08-29 トヨタ自動車株式会社 Vehicle electronic control unit, program update method and program

Also Published As

Publication number Publication date
US11886869B2 (en) 2024-01-30
DE112021000801T5 (en) 2022-12-22
JP2021121894A (en) 2021-08-26
JP7266216B2 (en) 2023-04-28
US20220121440A1 (en) 2022-04-21

Similar Documents

Publication Publication Date Title
JP5113700B2 (en) Firmware update apparatus and method
WO2011024688A1 (en) Firmware update system, and information apparatus, as well as program
CN102334100A (en) Program update device, program update method, and information processing device
KR20220084336A (en) Elastic software updates on secure storage devices
US7818557B2 (en) Method for re-imaging a computer system
CN110764486B (en) Method and device for operating vehicle-mounted controller, vehicle-mounted controller and storage medium
CN111026417A (en) Embedded equipment upgrading method and embedded equipment
US7904422B2 (en) System for deploying data from deployment-source device to deployment-destination device
WO2021153224A1 (en) Information processing device and information processing method
KR102123701B1 (en) Network boot system
WO2021117445A1 (en) Information processing device, mobile body, and information processing method
US20080027963A1 (en) Storage apparatus and program update method
JP2022184735A (en) Program starting method and device, and storage medium
JP2008217202A (en) Disk array device and firmware update method
US8918582B2 (en) Simulating EEPROM in virtual distributed switches
JP2002258971A (en) Method for restarting computer system
US11989435B2 (en) Re-partitioning of a flash memory device
JP6149624B2 (en) Firmware execution apparatus, firmware execution method, computer program, and computer apparatus
US20240211257A1 (en) Cache to Receive Firmware Generated Data During Firmware Update
CN110943871B (en) Resource interval adjusting method and device
US20230185564A1 (en) Control device and management method
CN112068928B (en) Virtual machine data storage method and system based on redirection
WO2020241473A1 (en) Computation processing device, vehicle control device, and update method
JP2005321967A (en) Information processor
JP5668518B2 (en) Information processing apparatus, information processing method, and program

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21748357

Country of ref document: EP

Kind code of ref document: A1

122 Ep: pct application non-entry in european phase

Ref document number: 21748357

Country of ref document: EP

Kind code of ref document: A1